Patch "netfilter: nf_tables: flush pending destroy work before netlink notifier" has been added to the 6.4-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    netfilter: nf_tables: flush pending destroy work before netlink notifier

to the 6.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-nf_tables-flush-pending-destroy-work-befor.patch
and it can be found in the queue-6.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit a0227f3bd4faa1bff72b7b65e1c309cfc3fb4088
Author: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date:   Fri Aug 18 01:13:31 2023 +0200

    netfilter: nf_tables: flush pending destroy work before netlink notifier
    
    [ Upstream commit 2c9f0293280e258606e54ed2b96fa71498432eae ]
    
    Destroy work waits for the RCU grace period then it releases the objects
    with no mutex held. All releases objects follow this path for
    transactions, therefore, order is guaranteed and references to top-level
    objects in the hierarchy remain valid.
    
    However, netlink notifier might interfer with pending destroy work.
    rcu_barrier() is not correct because objects are not release via RCU
    callback. Flush destroy work before releasing objects from netlink
    notifier path.
    
    Fixes: d4bc8271db21 ("netfilter: nf_tables: netlink notifier might race to release objects")
    Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 5275c4112b57d..539bc5d5c12fd 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -11084,7 +11084,7 @@ static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event,
 	gc_seq = nft_gc_seq_begin(nft_net);
 
 	if (!list_empty(&nf_tables_destroy_list))
-		rcu_barrier();
+		nf_tables_trans_destroy_flush_work();
 again:
 	list_for_each_entry(table, &nft_net->tables, list) {
 		if (nft_table_has_owner(table) &&



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux