This is a note to let you know that I've just added the patch titled
netfilter: nf_tables: hold mutex on netns pre_exit path
to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nf_tables-hold-mutex-on-netns-pre_exit-path.patch
and it can be found in the queue-5.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 3923b1e4406680d57da7e873da77b1683035d83f Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date: Mon, 30 May 2022 18:24:05 +0200
Subject: netfilter: nf_tables: hold mutex on netns pre_exit path
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
commit 3923b1e4406680d57da7e873da77b1683035d83f upstream.
clean_net() runs in workqueue while walking over the lists, grab mutex.
Fixes: 767d1216bff8 ("netfilter: nftables: fix possible UAF over chains from packet path in netns")
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/netfilter/nf_tables_api.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -8983,7 +8983,9 @@ static int __net_init nf_tables_init_net
static void __net_exit nf_tables_pre_exit_net(struct net *net)
{
+ mutex_lock(&net->nft.commit_mutex);
__nft_release_hooks(net);
+ mutex_unlock(&net->nft.commit_mutex);
}
static void __net_exit nf_tables_exit_net(struct net *net)
Patches currently in stable-queue which might be from pablo@xxxxxxxxxxxxx are
queue-5.10/ipvs-align-inner_mac_header-for-encapsulation.patch
queue-5.10/netfilter-nf_tables-disallow-element-updates-of-boun.patch
queue-5.10/netfilter-nf_tables-validate-registers-coming-from-userspace.patch
queue-5.10/netfilter-nfnetlink_osf-fix-module-autoload.patch
queue-5.10/netfilter-nf_tables-hold-mutex-on-netns-pre_exit-path.patch
queue-5.10/netfilter-nftables-statify-nft_parse_register.patch
queue-5.10/netfilter-nft_set_pipapo-.walk-does-not-deal-with-ge.patch
