Commit 78f29211 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Liu Jian
Browse files

netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout 

mainline inclusion
from mainline-v6.8
commit 552705a3650bbf46a22b1adedc1b04181490fc36
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9AK7L
CVE: CVE-2024-26643

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=552705a3650bbf46a22b1adedc1b04181490fc36



---------------------------

While the rhashtable set gc runs asynchronously, a race allows it to
collect elements from anonymous sets with timeouts while it is being
released from the commit path.

Mingi Cho originally reported this issue in a different path in 6.1.x
with a pipapo set with low timeouts which is not possible upstream since
7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set
element timeout").

Fix this by setting on the dead flag for anonymous sets to skip async gc
in this case.

According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on
transaction abort"), Florian plans to accelerate abort path by releasing
objects via workqueue, therefore, this sets on the dead flag for abort
path too.

Cc: stable@vger.kernel.org
Fixes: 5f68718b ("netfilter: nf_tables: GC transaction API to avoid race with control plane")
Reported-by: default avatarMingi Cho <mgcho.minic@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
parent 28ad13bd

net/netfilter/nf_tables_api.c

+1 −0
Original line number Diff line number Diff line
@@ -4724,6 +4724,7 @@ static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set, 


	if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) {

		list_del_rcu(&set->list);

		set->dead = 1;

		if (event)

			nf_tables_set_notify(ctx, set, NFT_MSG_DELSET,

					     GFP_KERNEL);