This is a note to let you know that I've just added the patch titled
netfilter: nf_tables: double hook unregistration in netns path
to the 5.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nf_tables-double-hook-unregistration-in-netns-path.patch
and it can be found in the queue-5.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From stable-owner@xxxxxxxxxxxxxxx Tue Nov 21 12:14:05 2023
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date: Tue, 21 Nov 2023 13:13:29 +0100
Subject: netfilter: nf_tables: double hook unregistration in netns path
To: netfilter-devel@xxxxxxxxxxxxxxx
Cc: gregkh@xxxxxxxxxxxxxxxxxxx, sashal@xxxxxxxxxx, stable@xxxxxxxxxxxxxxx
Message-ID: <20231121121333.294238-23-pablo@xxxxxxxxxxxxx>
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
commit f9a43007d3f7ba76d5e7f9421094f00f2ef202f8 upstream.
__nft_release_hooks() is called from pre_netns exit path which
unregisters the hooks, then the NETDEV_UNREGISTER event is triggered
which unregisters the hooks again.
[ 565.221461] WARNING: CPU: 18 PID: 193 at net/netfilter/core.c:495 __nf_unregister_net_hook+0x247/0x270
[...]
[ 565.246890] CPU: 18 PID: 193 Comm: kworker/u64:1 Tainted: G E 5.18.0-rc7+ #27
[ 565.253682] Workqueue: netns cleanup_net
[ 565.257059] RIP: 0010:__nf_unregister_net_hook+0x247/0x270
[...]
[ 565.297120] Call Trace:
[ 565.300900] <TASK>
[ 565.304683] nf_tables_flowtable_event+0x16a/0x220 [nf_tables]
[ 565.308518] raw_notifier_call_chain+0x63/0x80
[ 565.312386] unregister_netdevice_many+0x54f/0xb50
Unregister and destroy netdev hook from netns pre_exit via kfree_rcu
so the NETDEV_UNREGISTER path see unregistered hooks.
Fixes: 767d1216bff8 ("netfilter: nftables: fix possible UAF over chains from packet path in netns")
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/netfilter/nf_tables_api.c | 34 +++++++++++++++++++++++++++-------
net/netfilter/nft_chain_filter.c | 3 +++
2 files changed, 30 insertions(+), 7 deletions(-)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -219,9 +219,10 @@ static int nf_tables_register_hook(struc
return nf_register_net_hook(net, ops);
}
-static void nf_tables_unregister_hook(struct net *net,
- const struct nft_table *table,
- struct nft_chain *chain)
+static void __nf_tables_unregister_hook(struct net *net,
+ const struct nft_table *table,
+ struct nft_chain *chain,
+ bool release_netdev)
{
const struct nft_base_chain *basechain;
const struct nf_hook_ops *ops;
@@ -236,6 +237,16 @@ static void nf_tables_unregister_hook(st
return basechain->type->ops_unregister(net, ops);
nf_unregister_net_hook(net, ops);
+ if (release_netdev &&
+ table->family == NFPROTO_NETDEV)
+ nft_base_chain(chain)->ops.dev = NULL;
+}
+
+static void nf_tables_unregister_hook(struct net *net,
+ const struct nft_table *table,
+ struct nft_chain *chain)
+{
+ __nf_tables_unregister_hook(net, table, chain, false);
}
static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
@@ -5997,8 +6008,9 @@ nft_flowtable_type_get(struct net *net,
return ERR_PTR(-ENOENT);
}
-static void nft_unregister_flowtable_net_hooks(struct net *net,
- struct nft_flowtable *flowtable)
+static void __nft_unregister_flowtable_net_hooks(struct net *net,
+ struct nft_flowtable *flowtable,
+ bool release_netdev)
{
int i;
@@ -6007,9 +6019,17 @@ static void nft_unregister_flowtable_net
continue;
nf_unregister_net_hook(net, &flowtable->ops[i]);
+ if (release_netdev)
+ flowtable->ops[i].dev = NULL;
}
}
+static void nft_unregister_flowtable_net_hooks(struct net *net,
+ struct nft_flowtable *flowtable)
+{
+ __nft_unregister_flowtable_net_hooks(net, flowtable, false);
+}
+
static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,
struct sk_buff *skb,
const struct nlmsghdr *nlh,
@@ -8192,9 +8212,9 @@ static void __nft_release_hook(struct ne
struct nft_chain *chain;
list_for_each_entry(chain, &table->chains, list)
- nf_tables_unregister_hook(net, table, chain);
+ __nf_tables_unregister_hook(net, table, chain, true);
list_for_each_entry(flowtable, &table->flowtables, list)
- nft_unregister_flowtable_net_hooks(net, flowtable);
+ __nft_unregister_flowtable_net_hooks(net, flowtable, true);
}
static void __nft_release_hooks(struct net *net)
--- a/net/netfilter/nft_chain_filter.c
+++ b/net/netfilter/nft_chain_filter.c
@@ -296,6 +296,9 @@ static void nft_netdev_event(unsigned lo
if (strcmp(basechain->dev_name, dev->name) != 0)
return;
+ if (!basechain->ops.dev)
+ return;
+
/* UNREGISTER events are also happpening on netns exit.
*
* Altough nf_tables core releases all tables/chains, only
Patches currently in stable-queue which might be from stable-owner@xxxxxxxxxxxxxxx are
queue-5.4/netfilter-nf_tables-fix-memleak-when-more-than-255-elements-expired.patch
queue-5.4/netfilter-nft_set_rbtree-fix-overlap-expiration-walk.patch
queue-5.4/netfilter-nf_tables-use-correct-lock-to-protect-gc_list.patch
queue-5.4/netfilter-nf_tables-disable-toggling-dormant-table-state-more-than-once.patch
queue-5.4/netfilter-nf_tables-gc-transaction-race-with-netns-dismantle.patch
queue-5.4/netfilter-nf_tables-drop-map-element-references-from-preparation-phase.patch
queue-5.4/netfilter-nf_tables-fix-gc-transaction-races-with-netns-and-netlink-event-exit-path.patch
queue-5.4/netfilter-nf_tables-don-t-skip-expired-elements-during-walk.patch
queue-5.4/netfilter-nf_tables-remove-busy-mark-and-gc-batch-api.patch
queue-5.4/netfilter-nf_tables-gc-transaction-race-with-abort-path.patch
queue-5.4/netfilter-nf_tables-unregister-flowtable-hooks-on-netns-exit.patch
queue-5.4/netfilter-nft_set_rbtree-switch-to-node-list-walk-for-overlap-detection.patch
queue-5.4/netfilter-nf_tables-adapt-set-backend-to-use-gc-transaction-api.patch
queue-5.4/netfilter-nftables-rename-set-element-data-activation-deactivation-functions.patch
queue-5.4/netfilter-nft_set_rbtree-skip-sync-gc-for-new-elements-in-this-transaction.patch
queue-5.4/netfilter-nf_tables-pass-context-to-nft_set_destroy.patch
queue-5.4/netfilter-nf_tables-bogus-ebusy-when-deleting-flowtable-after-flush-for-5.4.patch
queue-5.4/netfilter-nft_set_hash-try-later-when-gc-hits-eagain-on-iteration.patch
queue-5.4/netfilter-nf_tables-defer-gc-run-if-previous-batch-is-still-pending.patch
queue-5.4/netfilter-nft_set_rbtree-use-read-spinlock-to-avoid-datapath-contention.patch
queue-5.4/netfilter-nf_tables-double-hook-unregistration-in-netns-path.patch
queue-5.4/netfilter-nftables-update-table-flags-from-the-commit-phase.patch
queue-5.4/netfilter-nft_set_hash-mark-set-element-as-dead-when-deleting-from-packet-path.patch
queue-5.4/netfilter-nf_tables-gc-transaction-api-to-avoid-race-with-control-plane.patch
queue-5.4/netfilter-nf_tables-fix-table-flag-updates.patch
queue-5.4/netfilter-nft_set_rbtree-fix-null-deref-on-element-insertion.patch
