From: Pablo Neira Ayuso Date: Mon, 30 May 2022 16:24:05 +0000 (+0200) Subject: netfilter: nf_tables: hold mutex on netns pre_exit path X-Git-Tag: archive/raspbian/5.10.179-3+rpi1^2~16 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=e71ecdd547f6211dca4a7b251e68bb34ab24a136;p=linux.git netfilter: nf_tables: hold mutex on netns pre_exit path Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit?id=8b7454dd984a75d0eaa6a02940c65cd3671fcddc commit 3923b1e4406680d57da7e873da77b1683035d83f upstream. clean_net() runs in workqueue while walking over the lists, grab mutex. Fixes: 767d1216bff8 ("netfilter: nftables: fix possible UAF over chains from packet path in netns") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman Gbp-Pq: Topic bugfix/all Gbp-Pq: Name netfilter-nf_tables-hold-mutex-on-netns-pre_exit-pat.patch --- diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 8958dda69a6..9ee9cba6138 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -8987,7 +8987,9 @@ static int __net_init nf_tables_init_net(struct net *net) static void __net_exit nf_tables_pre_exit_net(struct net *net) { + mutex_lock(&net->nft.commit_mutex); __nft_release_hooks(net); + mutex_unlock(&net->nft.commit_mutex); } static void __net_exit nf_tables_exit_net(struct net *net)