From patchwork Tue May 28 22:32:43 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1940818 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4VpnN43YpDz20f3 for ; Wed, 29 May 2024 08:33:07 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1sC5NI-0003mi-15; Tue, 28 May 2024 22:32:56 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1sC5NF-0003ld-Ve for kernel-team@lists.ubuntu.com; Tue, 28 May 2024 22:32:53 +0000 Received: from mail-ot1-f69.google.com (mail-ot1-f69.google.com [209.85.210.69]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 552B83F2B7 for ; Tue, 28 May 2024 22:32:52 +0000 (UTC) Received: by mail-ot1-f69.google.com with SMTP id 46e09a7af769-6f8eddcd3d4so1571687a34.3 for ; Tue, 28 May 2024 15:32:52 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1716935570; x=1717540370; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=6Zh4LXBuC2gpTWOIztfDhJfn/0+SRF0qLR1CDXxI0hk=; b=r4urSqNkXFx+68feEL4DqYEXhIupY72u9vSpe8bFBAd6KtB27DhD0SL2vAgJi64nVa C8ti6AQF2ilBwZKaf+/GBSpM31ItaLLkAKVK7COrQXYidwlBMl7QhBC9Nq5oHZG9kHIG iTUi7oP3mtsDYs9Qi6UW/VVGWuoCZIXCdXGjT+lWbsZBfRGwdlfc7DOQithSa1AZs4RQ pkaWwqGusnoaxg10AOf5zXrW0Xx7/uD3ht0CjJd2GyeVAMm7Grhnrz9aDPpbxMbAgYr5 PpuV2tcRdrl6JQbdHb4uRQ7sbvbnZdoKdHKbiBUTjwBwt7LM3nyCI3bWQeBHG7RRiBCF 7wJg== X-Gm-Message-State: AOJu0YwauMZg8bWxF55uspKt9MBofoRDl5Y6redRPOCleP9GObtVIrcB XO9DGHE01HTyelMTXTUID0fuY3L9JPyjPJRYaydJGSl19sekO7gRj+c13SA7XlAfwrSMbApp7nz jhSVFCaNFcQmFM8ehX36N/wBRHtv9Bz13Jbtps5QhLze++Kjzy9J0REMkHPbGgbMi1WdTORlyYp MqtYP9bdZwPQ== X-Received: by 2002:a05:6830:1b66:b0:6f0:ad78:1b75 with SMTP id 46e09a7af769-6f8d0a86ccemr14512936a34.22.1716935569688; Tue, 28 May 2024 15:32:49 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHXOIZstsIRctTTVljvWLvw7zlOlZUMul4CNZpEbQr+Hx7fW487fBhnMt+D+FcdW0t7dEGL8Q== X-Received: by 2002:a05:6830:1b66:b0:6f0:ad78:1b75 with SMTP id 46e09a7af769-6f8d0a86ccemr14512923a34.22.1716935569333; Tue, 28 May 2024 15:32:49 -0700 (PDT) Received: from smtp.gmail.com ([2600:1700:564:3480:97ae:ad19:5b77:5447]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-6f8d0e99dfdsm2083604a34.80.2024.05.28.15.32.49 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 28 May 2024 15:32:49 -0700 (PDT) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][M][PATCH 1/2] netfilter: nf_tables: release batch on table validation from abort path Date: Tue, 28 May 2024 17:32:43 -0500 Message-Id: <20240528223247.53626-2-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240528223247.53626-1-bethany.jamison@canonical.com> References: <20240528223247.53626-1-bethany.jamison@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Pablo Neira Ayuso Unlike early commit path stage which triggers a call to abort, an explicit release of the batch is required on abort, otherwise mutex is released and commit_list remains in place. Add WARN_ON_ONCE to ensure commit_list is empty from the abort path before releasing the mutex. After this patch, commit_list is always assumed to be empty before grabbing the mutex, therefore 03c1f1ef1584 ("netfilter: Cleanup nft_net->module_list from nf_tables_exit_net()") only needs to release the pending modules for registration. Cc: stable@vger.kernel.org Fixes: c0391b6ab810 ("netfilter: nf_tables: missing validation from the abort path") Signed-off-by: Pablo Neira Ayuso (cherry picked from commit a45e6889575c2067d3c0212b6bc1022891e65b91) CVE-2024-26925 Signed-off-by: Bethany Jamison --- net/netfilter/nf_tables_api.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index e908938ef5228..59e0953c0f5f7 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -10284,10 +10284,11 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) struct nft_trans *trans, *next; LIST_HEAD(set_update_list); struct nft_trans_elem *te; + int err = 0; if (action == NFNL_ABORT_VALIDATE && nf_tables_validate(net) < 0) - return -EAGAIN; + err = -EAGAIN; list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list, list) { @@ -10478,7 +10479,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) else nf_tables_module_autoload_cleanup(net); - return 0; + return err; } static int nf_tables_abort(struct net *net, struct sk_buff *skb, @@ -10491,6 +10492,9 @@ static int nf_tables_abort(struct net *net, struct sk_buff *skb, gc_seq = nft_gc_seq_begin(nft_net); ret = __nf_tables_abort(net, action); nft_gc_seq_end(nft_net, gc_seq); + + WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); + mutex_unlock(&nft_net->commit_mutex); return ret; @@ -11288,9 +11292,10 @@ static void __net_exit nf_tables_exit_net(struct net *net) gc_seq = nft_gc_seq_begin(nft_net); - if (!list_empty(&nft_net->commit_list) || - !list_empty(&nft_net->module_list)) - __nf_tables_abort(net, NFNL_ABORT_NONE); + WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); + + if (!list_empty(&nft_net->module_list)) + nf_tables_module_autoload_cleanup(net); __nft_release_tables(net); From patchwork Tue May 28 22:32:46 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1940817 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4VpnN42cCnz20Pc for ; Wed, 29 May 2024 08:33:07 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1sC5NK-0003nL-9D; Tue, 28 May 2024 22:32:58 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1sC5NF-0003lk-I8 for kernel-team@lists.ubuntu.com; Tue, 28 May 2024 22:32:53 +0000 Received: from mail-ot1-f72.google.com (mail-ot1-f72.google.com [209.85.210.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 418E13F339 for ; Tue, 28 May 2024 22:32:53 +0000 (UTC) Received: by mail-ot1-f72.google.com with SMTP id 46e09a7af769-6f8ebf9a645so1509705a34.3 for ; Tue, 28 May 2024 15:32:53 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1716935572; x=1717540372; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=YewRsiy7UGOLm5K5eeJ0c+dOrLkB+jOGo8oH5zdZxA4=; b=T5m4skegnl/lEAvd8su0+HP8Ss9NDIXnnIEZNH2QIdrTXWFsjKv8KK++eBzIZ/M7Nc InzzMDf0uD/hqDJX1cFYkW+PMUy2dd1mr5gEe6YcPkptCpdYjfbrn629y5k+78Qr3HV4 9VmTtwNVHlqg4qxW6YNURyR+1l+ZWexr6vm8fH5HgykbvuZV8+/wKUXlV3s/nhfXVy0x IX5ME+NlXx1g+d3QfSWQhTOFs3cv4L2bZQCoa9EqXB4o62/jQg8Vlz9955/6WNC8FePz 1ZcrfyKma/a6WOanTigfzeYT883sZ/gvCRhNPSVXioM5k8liqWh/oiAejAyB3DeqwkGC FPmg== X-Gm-Message-State: AOJu0YwwTBjF8ZHXmRWZHHmTGli3mIvqx9ofyuXmZMxJEiVN5tkkeW3Q QLtfhPNtrPqn+ENIRNUTktl4lon9/t5b8iqbKrm8mkMkHxCX6L6dKp83Xc9TKknL9wODt0AjBv/ AXP+uzaJ+objuEBIgt+tAhU3qZ8oL3a4U2LDibNDp+8oaf0wcmxaJJ+DS17hnaeqDuxpLbFPfUM D8rubfzUSA/A== X-Received: by 2002:a9d:74c2:0:b0:6f8:ee74:e70e with SMTP id 46e09a7af769-6f8ee74e776mr8279212a34.19.1716935571901; Tue, 28 May 2024 15:32:51 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGmxGplgGpAXXWnL6UPDRPWBiNVHS3vnBCKGgON0AKrGpn9IlROWv2htJ3fGlscexn19A7zEQ== X-Received: by 2002:a9d:74c2:0:b0:6f8:ee74:e70e with SMTP id 46e09a7af769-6f8ee74e776mr8279190a34.19.1716935571435; Tue, 28 May 2024 15:32:51 -0700 (PDT) Received: from smtp.gmail.com ([2600:1700:564:3480:97ae:ad19:5b77:5447]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-6f8d0e99dfdsm2083604a34.80.2024.05.28.15.32.50 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 28 May 2024 15:32:51 -0700 (PDT) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][F][PATCH 2/3] netfilter: nf_tables: release batch on table validation from abort path Date: Tue, 28 May 2024 17:32:46 -0500 Message-Id: <20240528223247.53626-5-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240528223247.53626-1-bethany.jamison@canonical.com> References: <20240528223247.53626-1-bethany.jamison@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Pablo Neira Ayuso Unlike early commit path stage which triggers a call to abort, an explicit release of the batch is required on abort, otherwise mutex is released and commit_list remains in place. Add WARN_ON_ONCE to ensure commit_list is empty from the abort path before releasing the mutex. After this patch, commit_list is always assumed to be empty before grabbing the mutex, therefore 03c1f1ef1584 ("netfilter: Cleanup nft_net->module_list from nf_tables_exit_net()") only needs to release the pending modules for registration. Cc: stable@vger.kernel.org Fixes: c0391b6ab810 ("netfilter: nf_tables: missing validation from the abort path") Signed-off-by: Pablo Neira Ayuso (cherry picked from commit a45e6889575c2067d3c0212b6bc1022891e65b91) [bjamison: context conflict due to extra whitespace in Focal, accepted incoming change as is] CVE-2024-26925 Signed-off-by: Bethany Jamison --- net/netfilter/nf_tables_api.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 23638531aa089..d9848f5edc788 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -7573,10 +7573,11 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id); struct nft_trans *trans, *next; struct nft_trans_elem *te; + int err = 0; if (action == NFNL_ABORT_VALIDATE && nf_tables_validate(net) < 0) - return -EAGAIN; + err = -EAGAIN; list_for_each_entry_safe_reverse(trans, next, &nft_net->commit_list, list) { @@ -7709,7 +7710,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) else nf_tables_module_autoload_cleanup(net); - return 0; + return err; } static int nf_tables_abort(struct net *net, struct sk_buff *skb, @@ -7723,6 +7724,8 @@ static int nf_tables_abort(struct net *net, struct sk_buff *skb, ret = __nf_tables_abort(net, action); nft_gc_seq_end(nft_net, gc_seq); + WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); + mutex_unlock(&nft_net->commit_mutex); return ret; @@ -8409,9 +8412,11 @@ static void __net_exit nf_tables_exit_net(struct net *net) gc_seq = nft_gc_seq_begin(nft_net); - if (!list_empty(&nft_net->commit_list) || - !list_empty(&nft_net->module_list)) - __nf_tables_abort(net, NFNL_ABORT_NONE); + WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); + + if (!list_empty(&nft_net->module_list)) + nf_tables_module_autoload_cleanup(net); + __nft_release_tables(net); nft_gc_seq_end(nft_net, gc_seq); From patchwork Tue May 28 22:32:47 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1940820 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4VpnN43hGcz23vC for ; Wed, 29 May 2024 08:33:07 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1sC5NL-0003oD-DN; Tue, 28 May 2024 22:32:59 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1sC5NG-0003m9-Bl for kernel-team@lists.ubuntu.com; Tue, 28 May 2024 22:32:54 +0000 Received: from mail-ot1-f70.google.com (mail-ot1-f70.google.com [209.85.210.70]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 1B83A3F339 for ; Tue, 28 May 2024 22:32:54 +0000 (UTC) Received: by mail-ot1-f70.google.com with SMTP id 46e09a7af769-6f8f3e1178eso1495511a34.3 for ; Tue, 28 May 2024 15:32:54 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1716935572; x=1717540372; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=USJE7Bw7JF7mXEP1qkjjdkZ1jNGZfn/hLkgke9kmcKw=; b=dYqEyKKO6Xr8sDjqhe6Te0/tzqnf0sH783zOe/j+M2QSDeiUATuTXq7zq4e8ZiBqKn TB+ppRxghWd90PNrcsONKDgO+1penG0QtWLFhaRh/LYOZL6F5wWX7ElbCx8v7s+It5th 7bA2HH59hy0fmrVXXnhq0pm+Pg7dGYI3zDpbVO+6O74kHggmayvJd4L5Z6613ZI6U2Ip 98xPFKFZ+s3vaYx21UC7uR3s7Gq+nr8vtNL/Njiyecu3skBz+C3GmP2SMTjW+LXbujiN t+6kCZlsa2kTVjxUDx0nKnJkm5BShx0MIaL722cidxGfumPeUv63h+7qGllQ6LLW+C3y JEfw== X-Gm-Message-State: AOJu0Yz8/wQSHIdUh15HSiI0SQdwi/gpaNpX3LqiZ+5Z6WUrIz1kPoJj afVbb9f6H/mwo9NC4VM3IOqrjwhDQI9R/yqIQ41U3yALvpRlq98d7wRKdQFJLEIGMExB80rKAQq c1O4BcwSbWvmvYjVl90ut7R2oASEkKGcQIlqKA2DhxcZfJKSKdO7ArtlIRMbcSa+5Yi9I2alX/9 qI+L+9eiafNQ== X-Received: by 2002:a05:6830:1445:b0:6f1:413d:8e09 with SMTP id 46e09a7af769-6f8d0b88ca0mr13080464a34.26.1716935572679; Tue, 28 May 2024 15:32:52 -0700 (PDT) X-Google-Smtp-Source: AGHT+IEZ6XgPoDrhaCOLWnkyMPY5TP3+8NamPIyfCf9ZeTPc7/L98y9SlAPr107pOp0uOuF/oiUx4A== X-Received: by 2002:a05:6830:1445:b0:6f1:413d:8e09 with SMTP id 46e09a7af769-6f8d0b88ca0mr13080437a34.26.1716935572024; Tue, 28 May 2024 15:32:52 -0700 (PDT) Received: from smtp.gmail.com ([2600:1700:564:3480:97ae:ad19:5b77:5447]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-6f8d0e99dfdsm2083604a34.80.2024.05.28.15.32.51 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 28 May 2024 15:32:51 -0700 (PDT) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][F][PATCH 3/3] netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path Date: Tue, 28 May 2024 17:32:47 -0500 Message-Id: <20240528223247.53626-6-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240528223247.53626-1-bethany.jamison@canonical.com> References: <20240528223247.53626-1-bethany.jamison@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Pablo Neira Ayuso The commit mutex should not be released during the critical section between nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC worker could collect expired objects and get the released commit lock within the same GC sequence. nf_tables_module_autoload() temporarily releases the mutex to load module dependencies, then it goes back to replay the transaction again. Move it at the end of the abort phase after nft_gc_seq_end() is called. Cc: stable@vger.kernel.org Fixes: 720344340fb9 ("netfilter: nf_tables: GC transaction race with abort path") Reported-by: Kuan-Ting Chen Signed-off-by: Pablo Neira Ayuso (cherry picked from commit 0d459e2ffb541841714839e8228b845458ed3b27) CVE-2024-26925 Signed-off-by: Bethany Jamison --- net/netfilter/nf_tables_api.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index d9848f5edc788..4db8723ed7c51 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -7705,11 +7705,6 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) nf_tables_abort_release(trans); } - if (action == NFNL_ABORT_AUTOLOAD) - nf_tables_module_autoload(net); - else - nf_tables_module_autoload_cleanup(net); - return err; } @@ -7726,6 +7721,14 @@ static int nf_tables_abort(struct net *net, struct sk_buff *skb, WARN_ON_ONCE(!list_empty(&nft_net->commit_list)); + /* module autoload needs to happen after GC sequence update because it + * temporarily releases and grabs mutex again. + */ + if (action == NFNL_ABORT_AUTOLOAD) + nf_tables_module_autoload(net); + else + nf_tables_module_autoload_cleanup(net); + mutex_unlock(&nft_net->commit_mutex); return ret;