A crash happened on ppc64le when running ltp network tests triggered by "rmmod iptable_mangle". See previous discussion in this thread: https://lists.openwall.net/netdev/2020/06/03/161 . In the crash I found in iptable_mangle_hook() that state->net->ipv4.iptable_mangle=NULL causing a NULL pointer dereference. net->ipv4.iptable_mangle is set to NULL in iptable_mangle_net_exit() and called when ip_mangle modules is unloaded. A rmmod task was found running in the crash dump. A 2nd crash showed the same problem when running "rmmod iptable_filter" (net->ipv4.iptable_filter=NULL). To fix this I added .pre_exit hook in all iptable_foo.c. The pre_exit will un-register the underlying hook and exit would do the table freeing. The netns core does an unconditional synchronize_rcu after the pre_exit hooks insuring no packets are in flight that have picked up the pointer before completing the un-register. These patches include changes for both iptables and ip6tables. We tested this fix with ltp running iptables01.sh and iptables01.sh -6 a loop for 72 hours. Signed-off-by: David Wilder <dwilder@xxxxxxxxxx> David Wilder (4): netfilter: Split ipt_unregister_table() into pre_exit and exit helpers. netfilter: Add a .pre_exit hook in all iptable_foo.c. netfilter: Split ip6t_unregister_table() into pre_exit and exit helpers. netfilter: Add a .pre_exit hook in all ip6table_foo.c. include/linux/netfilter_ipv4/ip_tables.h | 6 ++++++ include/linux/netfilter_ipv6/ip6_tables.h | 3 +++ net/ipv4/netfilter/ip_tables.c | 15 ++++++++++++++- net/ipv4/netfilter/iptable_filter.c | 10 +++++++++- net/ipv4/netfilter/iptable_mangle.c | 10 +++++++++- net/ipv4/netfilter/iptable_nat.c | 10 ++++++++-- net/ipv4/netfilter/iptable_raw.c | 10 +++++++++- net/ipv4/netfilter/iptable_security.c | 11 +++++++++-- net/ipv6/netfilter/ip6_tables.c | 15 ++++++++++++++- net/ipv6/netfilter/ip6table_filter.c | 10 +++++++++- net/ipv6/netfilter/ip6table_mangle.c | 10 +++++++++- net/ipv6/netfilter/ip6table_nat.c | 10 ++++++++-- net/ipv6/netfilter/ip6table_raw.c | 10 +++++++++- net/ipv6/netfilter/ip6table_security.c | 10 +++++++++- 14 files changed, 125 insertions(+), 15 deletions(-) -- 1.8.3.1
