Patch "netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()" has been added to the 5.4-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-nf_tables-fix-potential-data-race-in-__nft.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 518fe96715e41fc744cabf20338b86c159b00533
Author: Ziyang Xuan <william.xuanziyang@xxxxxxxxxx>
Date:   Sun Apr 7 14:56:04 2024 +0800

    netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
    
    [ Upstream commit f969eb84ce482331a991079ab7a5c4dc3b7f89bf ]
    
    nft_unregister_expr() can concurrent with __nft_expr_type_get(),
    and there is not any protection when iterate over nf_tables_expressions
    list in __nft_expr_type_get(). Therefore, there is potential data-race
    of nf_tables_expressions list entry.
    
    Use list_for_each_entry_rcu() to iterate over nf_tables_expressions
    list in __nft_expr_type_get(), and use rcu_read_lock() in the caller
    nft_expr_type_get() to protect the entire type query process.
    
    Fixes: ef1f7df9170d ("netfilter: nf_tables: expression ops overloading")
    Signed-off-by: Ziyang Xuan <william.xuanziyang@xxxxxxxxxx>
    Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index b4bb93b9aafc7..8131d858f38d9 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2239,7 +2239,7 @@ static const struct nft_expr_type *__nft_expr_type_get(u8 family,
 {
 	const struct nft_expr_type *type, *candidate = NULL;
 
-	list_for_each_entry(type, &nf_tables_expressions, list) {
+	list_for_each_entry_rcu(type, &nf_tables_expressions, list) {
 		if (!nla_strcmp(nla, type->name)) {
 			if (!type->family && !candidate)
 				candidate = type;
@@ -2271,9 +2271,13 @@ static const struct nft_expr_type *nft_expr_type_get(struct net *net,
 	if (nla == NULL)
 		return ERR_PTR(-EINVAL);
 
+	rcu_read_lock();
 	type = __nft_expr_type_get(family, nla);
-	if (type != NULL && try_module_get(type->owner))
+	if (type != NULL && try_module_get(type->owner)) {
+		rcu_read_unlock();
 		return type;
+	}
+	rcu_read_unlock();
 
 	lockdep_nfnl_nft_mutex_not_held();
 #ifdef CONFIG_MODULES




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux