Re: [PATCH nf] netfilter: nf_tables: unlink table before deleting it

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


On Mon, Sep 13, 2021 at 02:42:33PM +0200, Florian Westphal wrote:
> syzbot reports following UAF:
> BUG: KASAN: use-after-free in memcmp+0x18f/0x1c0 lib/string.c:955
>  nla_strcmp+0xf2/0x130 lib/nlattr.c:836
>  nft_table_lookup.part.0+0x1a2/0x460 net/netfilter/nf_tables_api.c:570
>  nft_table_lookup net/netfilter/nf_tables_api.c:4064 [inline]
>  nf_tables_getset+0x1b3/0x860 net/netfilter/nf_tables_api.c:4064
>  nfnetlink_rcv_msg+0x659/0x13f0 net/netfilter/nfnetlink.c:285
>  netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504
> Problem is that all get operations are lockless, so the commit_mutex
> held by nft_rcv_nl_event() isn't enough to stop a parallel GET request
> from doing read-accesses to the table object even after synchronize_rcu().
> To avoid this, unlink the table first and store the table objects in
> on-stack scratch space.

Applied, thanks.

[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux