Patch "netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-nf_tables-use-rcu-chain-hook-list-iterator.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit c0aa7dd11211cfe90250eeddc3d5cd663d35171f
Author: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date:   Tue Sep 17 23:07:46 2024 +0200

    netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path
    
    [ Upstream commit 4ffcf5ca81c3b83180473eb0d3c010a1a7c6c4de ]
    
    Lockless iteration over hook list is possible from netlink dump path,
    use rcu variant to iterate over the hook list as is done with flowtable
    hooks.
    
    Fixes: b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain")
    Reported-by: Phil Sutter <phil@xxxxxx>
    Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 935e953b8e1bf..da7fd3919ce48 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1778,7 +1778,7 @@ static int nft_dump_basechain_hook(struct sk_buff *skb, int family,
 		if (!hook_list)
 			hook_list = &basechain->hook_list;
 
-		list_for_each_entry(hook, hook_list, list) {
+		list_for_each_entry_rcu(hook, hook_list, list) {
 			if (!first)
 				first = hook;