This is a note to let you know that I've just added the patch titled
netfilter: nf_tables: hold mutex on netns pre_exit path
to the 5.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nf_tables-hold-mutex-on-netns-pre_exit-pat.patch
and it can be found in the queue-5.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit d2227be0586c0031c775ffe845967d7e83567bb4
Author: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date: Tue May 16 16:44:35 2023 +0200
netfilter: nf_tables: hold mutex on netns pre_exit path
[ 3923b1e4406680d57da7e873da77b1683035d83f ]
clean_net() runs in workqueue while walking over the lists, grab mutex.
Fixes: 767d1216bff8 ("netfilter: nftables: fix possible UAF over chains from packet path in netns")
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index e4eef4947cc75..909076ef157e8 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -7866,7 +7866,9 @@ static int __net_init nf_tables_init_net(struct net *net)
static void __net_exit nf_tables_pre_exit_net(struct net *net)
{
+ mutex_lock(&net->nft.commit_mutex);
__nft_release_hooks(net);
+ mutex_unlock(&net->nft.commit_mutex);
}
static void __net_exit nf_tables_exit_net(struct net *net)
