Commit 20fdfa73 authored by Jozsef Kadlecsik's avatar Jozsef Kadlecsik Committed by Liu Jian
Browse files

netfilter: ipset: Fix suspicious rcu_dereference_protected() 

stable inclusion
from stable-v6.6.36
commit 94dd411c18d7fff9e411555d5c662d29416501e4
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACQJH
CVE: CVE-2024-39503

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=94dd411c18d7fff9e411555d5c662d29416501e4



---------------------------

[ Upstream commit 8ecd06277a7664f4ef018abae3abd3451d64e7a6 ]

When destroying all sets, we are either in pernet exit phase or
are executing a "destroy all sets command" from userspace. The latter
was taken into account in ip_set_dereference() (nfnetlink mutex is held),
but the former was not. The patch adds the required check to
rcu_dereference_protected() in ip_set_dereference().

Fixes: 4e7aaa6b82d6 ("netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type")
Reported-by: default avatar <syzbot+b62c37cdd58103293a5a@syzkaller.appspotmail.com>
Reported-by: default avatar <syzbot+cfbe1da5fdfc39efc293@syzkaller.appspotmail.com>
Reported-by: default avatarkernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202406141556.e0b6f17e-lkp@intel.com


Signed-off-by: default avatarJozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
parent 45047eb1

net/netfilter/ipset/ip_set_core.c

+6 −5
Original line number Diff line number Diff line
@@ -53,12 +53,13 @@ MODULE_DESCRIPTION("core IP set support"); 
MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET);



/* When the nfnl mutex or ip_set_ref_lock is held: */

#define ip_set_dereference(p)		\

	rcu_dereference_protected(p,	\

#define ip_set_dereference(inst)	\

	rcu_dereference_protected((inst)->ip_set_list,	\

		lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET) || \

		lockdep_is_held(&ip_set_ref_lock))

		lockdep_is_held(&ip_set_ref_lock) || \

		(inst)->is_deleted)

#define ip_set(inst, id)		\

	ip_set_dereference((inst)->ip_set_list)[id]

	ip_set_dereference(inst)[id]

#define ip_set_ref_netlink(inst,id)	\

	rcu_dereference_raw((inst)->ip_set_list)[id]

#define ip_set_dereference_nfnl(p)	\
@@ -1133,7 +1134,7 @@ static int ip_set_create(struct sk_buff *skb, const struct nfnl_info *info, 
		if (!list)

			goto cleanup;

		/* nfnl mutex is held, both lists are valid */

		tmp = ip_set_dereference(inst->ip_set_list);

		tmp = ip_set_dereference(inst);

		memcpy(list, tmp, sizeof(struct ip_set *) * inst->ip_set_max);

		rcu_assign_pointer(inst->ip_set_list, list);

		/* Make sure all current packets have passed through */