From patchwork Tue May 28 22:32:46 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1940817 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4VpnN42cCnz20Pc for ; Wed, 29 May 2024 08:33:07 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1sC5NK-0003nL-9D; Tue, 28 May 2024 22:32:58 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1sC5NF-0003lk-I8 for kernel-team@lists.ubuntu.com; Tue, 28 May 2024 22:32:53 +0000 Received: from mail-ot1-f72.google.com (mail-ot1-f72.google.com [209.85.210.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 418E13F339 for ; Tue, 28 May 2024 22:32:53 +0000 (UTC) Received: by mail-ot1-f72.google.com with SMTP id 46e09a7af769-6f8ebf9a645so1509705a34.3 for ; Tue, 28 May 2024 15:32:53 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1716935572; x=1717540372; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=YewRsiy7UGOLm5K5eeJ0c+dOrLkB+jOGo8oH5zdZxA4=; b=T5m4skegnl/lEAvd8su0+HP8Ss9NDIXnnIEZNH2QIdrTXWFsjKv8KK++eBzIZ/M7Nc InzzMDf0uD/hqDJX1cFYkW+PMUy2dd1mr5gEe6YcPkptCpdYjfbrn629y5k+78Qr3HV4 9VmTtwNVHlqg4qxW6YNURyR+1l+ZWexr6vm8fH5HgykbvuZV8+/wKUXlV3s/nhfXVy0x IX5ME+NlXx1g+d3QfSWQhTOFs3cv4L2bZQCoa9EqXB4o62/jQg8Vlz9955/6WNC8FePz 1ZcrfyKma/a6WOanTigfzeYT883sZ/gvCRhNPSVXioM5k8liqWh/oiAejAyB3DeqwkGC FPmg== X-Gm-Message-State: AOJu0YwwTBjF8ZHXmRWZHHmTGli3mIvqx9ofyuXmZMxJEiVN5tkkeW3Q QLtfhPNtrPqn+ENIRNUTktl4lon9/t5b8iqbKrm8mkMkHxCX6L6dKp83Xc9TKknL9wODt0AjBv/ AXP+uzaJ+objuEBIgt+tAhU3qZ8oL3a4U2LDibNDp+8oaf0wcmxaJJ+DS17hnaeqDuxpLbFPfUM D8rubfzUSA/A== X-Received: by 2002:a9d:74c2:0:b0:6f8:ee74:e70e with SMTP id 46e09a7af769-6f8ee74e776mr8279212a34.19.1716935571901; Tue, 28 May 2024 15:32:51 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGmxGplgGpAXXWnL6UPDRPWBiNVHS3vnBCKGgON0AKrGpn9IlROWv2htJ3fGlscexn19A7zEQ== X-Received: by 2002:a9d:74c2:0:b0:6f8:ee74:e70e with SMTP id 46e09a7af769-6f8ee74e776mr8279190a34.19.1716935571435; Tue, 28 May 2024 15:32:51 -0700 (PDT) Received: from smtp.gmail.com ([2600:1700:564:3480:97ae:ad19:5b77:5447]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-6f8d0e99dfdsm2083604a34.80.2024.05.28.15.32.50 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 28 May 2024 15:32:51 -0700 (PDT) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][F][PATCH 2/3] netfilter: nf_tables: release batch on table validation from abort path Date: Tue, 28 May 2024 17:32:46 -0500 Message-Id: <20240528223247.53626-5-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240528223247.53626-1-bethany.jamison@canonical.com> References: <20240528223247.53626-1-bethany.jamison@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Pablo Neira Ayuso Unlike early commit path stage which triggers a call to abort, an explicit release of the batch is required on abort, otherwise mutex is released and commit_list remains in place. Add WARN_ON_ONCE to ensure commit_list is empty from the abort path before releasing the mutex. After this patch, commit_list is always assumed to be empty before grabbing the mutex, therefore 03c1f1ef1584 ("netfilter: Cleanup nft_net->module_list from nf_tables_exit_net()") only needs to release the pending modules for registration. Cc: stable@vger.kernel.org Fixes: c0391b6ab810 ("netfilter: nf_tables: missing validation from the abort path") Signed-off-by: Pablo Neira Ayuso (cherry picked from commit a45e6889575c2067d3c0212b6bc1022891e65b91) [bjamison: context conflict due to extra whitespace in Focal, accepted incoming change as is] CVE-2024-26925 Signed-off-by: Bethany Jamison --- net/netfilter/nf_tables_api.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 23638531aa089..d9848f5edc788 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -7573,10 +7573,11 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); struct nft_trans *trans, *next; struct nft_trans_elem *te; + int err = 0; if (action == NFNL_ABORT_VALIDATE && nf_tables_validate(net) < 0) - return -EAGAIN; + err = -EAGAIN; list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list, list) { @@ -7709,7 +7710,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) else nf_tables_module_autoload_cleanup(net); - return 0; + return err; } static int nf_tables_abort(struct net *net, struct sk_buff *skb, @@ -7723,6 +7724,8 @@ static int nf_tables_abort(struct net *net, struct sk_buff *skb, ret = __nf_tables_abort(net, action); nft_gc_seq_end(nft_net, gc_seq); + WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); + mutex_unlock(&nft_net->commit_mutex); return ret; @@ -8409,9 +8412,11 @@ static void __net_exit nf_tables_exit_net(struct net *net) gc_seq = nft_gc_seq_begin(nft_net); - if (!list_empty(&nft_net->commit_list) || - !list_empty(&nft_net->module_list)) - __nf_tables_abort(net, NFNL_ABORT_NONE); + WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); + + if (!list_empty(&nft_net->module_list)) + nf_tables_module_autoload_cleanup(net); + __nft_release_tables(net); nft_gc_seq_end(nft_net, gc_seq);