Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.0/patches/2221243/?format=api
{ "id": 2221243, "url": "http://patchwork.ozlabs.org/api/1.0/patches/2221243/?format=api", "project": { "id": 15, "url": "http://patchwork.ozlabs.org/api/1.0/projects/15/?format=api", "name": "Ubuntu Kernel", "link_name": "ubuntu-kernel", "list_id": "kernel-team.lists.ubuntu.com", "list_email": "kernel-team@lists.ubuntu.com", "web_url": null, "scm_url": null, "webscm_url": null }, "msgid": "<20260408221230.1835720-2-tim.whisonant@canonical.com>", "date": "2026-04-08T22:11:50", "name": "[SRU,J,1/1] netfilter: nf_tables: release flowtable after rcu grace period on error", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "fdb5ef98b72849e3ffbfbdcb980f96b3da15adc6", "submitter": { "id": 89903, "url": "http://patchwork.ozlabs.org/api/1.0/people/89903/?format=api", "name": "Tim Whisonant", "email": "tim.whisonant@canonical.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20260408221230.1835720-2-tim.whisonant@canonical.com/mbox/", "series": [ { "id": 499219, "url": "http://patchwork.ozlabs.org/api/1.0/series/499219/?format=api", "date": "2026-04-08T22:11:49", "name": "CVE-2026-23392", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/499219/mbox/" } ], "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2221243/checks/", "tags": {}, "headers": { "Return-Path": "<kernel-team-bounces@lists.ubuntu.com>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=sXpC3cRI;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4frcks3R2Zz1yD3\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 09 Apr 2026 08:12:52 +1000 (AEST)", "from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1wAb8d-0007ao-Dk; Wed, 08 Apr 2026 22:12:43 +0000", "from smtp-relay-internal-0.internal ([10.131.114.225]\n helo=smtp-relay-internal-0.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from <tim.whisonant@canonical.com>)\n id 1wAb8b-0007Z0-Jj\n for kernel-team@lists.ubuntu.com; Wed, 08 Apr 2026 22:12:41 +0000", "from mail-yw1-f200.google.com (mail-yw1-f200.google.com\n [209.85.128.200])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 68E563F652\n for <kernel-team@lists.ubuntu.com>; Wed, 8 Apr 2026 22:12:41 +0000 (UTC)", "by mail-yw1-f200.google.com with SMTP id\n 00721157ae682-79878791ec6so5043907b3.3\n for <kernel-team@lists.ubuntu.com>; Wed, 08 Apr 2026 15:12:41 -0700 (PDT)", "from localhost (104-6-108-11.lightspeed.frokca.sbcglobal.net.\n [104.6.108.11]) by smtp.gmail.com with ESMTPSA id\n 00721157ae682-7a370df17c1sm94370987b3.37.2026.04.08.15.12.37\n for <kernel-team@lists.ubuntu.com>\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Wed, 08 Apr 2026 15:12:38 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1775686361;\n bh=dfbHnZ6WzQ3ALSJ9ta1wKRvfakr+DD8mxJB/uW9hTBw=;\n h=From:To:Subject:Date:Message-ID:In-Reply-To:References:\n MIME-Version;\n b=sXpC3cRIlGoymG+rsaCJ7z+OqMewGfBklA/5+65SR7U26DKlGLyuOpALMB3oWgxV4\n Z7tfMfOIlTlKzhaLgsDxok4G5ByAC9d8RGVCpuT5DOG6RESpa4LJ4dXNoHejxG21ON\n o5KPzKR3epuPaDG2C5WzWG9/xKYzSfK4l49sBNVXWJU344R+qOQbWTrfUwHnZg05u8\n s9kVnCFoP0k9nMSpg8QPYgFHuNYS7sK2aYNqzshgHOSuecIMAH3AtA+RIK7OiuGcjb\n vgi3+5fxA6SkOZKnySngc7GWrJTzSDE1DzckhKBWwu7BcwawSMgI6S7FkbNH4kwX6l\n z/rFc+hV/+1oih+PYK1uHRG6aHARy4MmWp6sCvcvYzvTZtvN4uj5srYhLxgRoAcJnv\n 7bD2SKu9Fy2aJFopBm9U4sB4mHhy5zNsG2xaNKsZKkI1utpHs6vSp3VXotyVfVo+tO\n widyNp73u0M9oUXi6Z0qlHaHYVZgsDmqCE4l1O7O4YEWr2nAhWHs+aYD6aeQ8FWHff\n CotTWydympE4kqG5C4y0Zus9RrUH7F4degkGfEcvZx0qmE1yJ/YyXs6DQ9EFilo/W5\n Xi0nxOLFRuO7AWr83lvH7Dgwq4/uFSyeWQuTQhj62tPjemnwdP4leX2yIphp0t9dFP\n pwBA/SAxBfvrhQ14+bCU3KLc=", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1775686359; x=1776291159;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to\n :cc:subject:date:message-id:reply-to;\n bh=dfbHnZ6WzQ3ALSJ9ta1wKRvfakr+DD8mxJB/uW9hTBw=;\n b=bXOdJS/5Dw1SHCcbKqoiYPD5o0ply+1A0AntKG4HPhTn+AByW9J+WWihPdNMrFLeJ9\n veZ101Qrajnk5W+jQgsL3829WlYWier7eUSm5rmQsTXSzWa/ExljDHcgFP+QadJ5IgoV\n C/sOKpwIFsHQ/LpipYJ0EYyBDcVFK+Wq9ffU/R5zlb2X470Bp717LD+agLzy/A9YqIYr\n oof81Mlae90as5Ayf9ZdAKc1SOIKNWDMSQ3Tcgy3TlSWtAseqnfOvwEcN2KkwsbDIRkC\n nXNB8faCcTnEHyoLoh68y01FENoekVsK4GUhk/XC1+qhS/pj3pK2i+aFbHdQOlWMWtVR\n v4ow==", "X-Gm-Message-State": "AOJu0YyIeYEobKVzGDgnpVG7BCsUA8ldsh1mRlOTtC2s1z7Yl7pT3NCS\n sCcrUvumbfcQ/B7zP883Kc3k9qDlN/7SG1YRSf1APQyv6AcKiGbMcmVtYrpKRuBJm3n7baNRu9p\n L2E488swYYdJEMAJUq/ZVkLi0/Zhtqgk0sdcsQtnOqiNNd10/yabQp5kNgtiQhmLCgk9bY1zVaq\n 84/Fwh3hruc7BVPA==", "X-Gm-Gg": "AeBDiet7hYq4PYOBNRUxgPxlRUwI/v1VKiqXpz4Gz7y3gblUezLEWbMqJrfNVBcPCs5\n 5EpE2HYQHJw+Qp38bKn+/CO3kfa2jbL0KKIYJc9ODQ7lKzce8n9vpgzz/HGZkdw9QunTXKFuFgj\n imUUcyS10GabY0E/OresSYwJJHSPNyx9mxj92zL8+CJa7zXU9PmTvzYz5yhh6UWWtzlp2PwSyKu\n 8ASCVPOiJvfVY0u7sw+eZ6p3dzdfA5CMzjRKN/bzNtAQdk+Y+0iFaNQJkQ/FBudoknM9LY5ugL8\n NJ/xDU0oXPVuf9AYupHEc9C7ofFatG7qzqSmpRYYuuCByb1BFZgzuxU6+1QOQGglYUNHMCv9ljK\n F5L4N1L5+PuIMWJlxatjvQoEoQPQMuGivL/QyNpWeooc8JRAGjoUN/DhJHvmNvBLH0R+eXtmHNq\n NnuA==", "X-Received": [ "by 2002:a05:690c:d8f:b0:79d:81a:1f86 with SMTP id\n 00721157ae682-7a4d86c0e40mr225508217b3.31.1775686359217;\n Wed, 08 Apr 2026 15:12:39 -0700 (PDT)", "by 2002:a05:690c:d8f:b0:79d:81a:1f86 with SMTP id\n 00721157ae682-7a4d86c0e40mr225508037b3.31.1775686358832;\n Wed, 08 Apr 2026 15:12:38 -0700 (PDT)" ], "From": "Tim Whisonant <tim.whisonant@canonical.com>", "To": "kernel-team@lists.ubuntu.com", "Subject": "[SRU][J][PATCH 1/1] netfilter: nf_tables: release flowtable after rcu\n grace period on error", "Date": "Wed, 8 Apr 2026 15:11:50 -0700", "Message-ID": "<20260408221230.1835720-2-tim.whisonant@canonical.com>", "X-Mailer": "git-send-email 2.43.0", "In-Reply-To": "<20260408221230.1835720-1-tim.whisonant@canonical.com>", "References": "<20260408221230.1835720-1-tim.whisonant@canonical.com>", "MIME-Version": "1.0", "X-BeenThere": "kernel-team@lists.ubuntu.com", "X-Mailman-Version": "2.1.20", "Precedence": "list", "List-Id": "Kernel team discussions <kernel-team.lists.ubuntu.com>", "List-Unsubscribe": "<https://lists.ubuntu.com/mailman/options/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>", "List-Archive": "<https://lists.ubuntu.com/archives/kernel-team>", "List-Post": "<mailto:kernel-team@lists.ubuntu.com>", "List-Help": "<mailto:kernel-team-request@lists.ubuntu.com?subject=help>", "List-Subscribe": "<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>", "Content-Type": "text/plain; charset=\"utf-8\"", "Content-Transfer-Encoding": "base64", "Errors-To": "kernel-team-bounces@lists.ubuntu.com", "Sender": "\"kernel-team\" <kernel-team-bounces@lists.ubuntu.com>" }, "content": "From: Pablo Neira Ayuso <pablo@netfilter.org>\n\nCall synchronize_rcu() after unregistering the hooks from error path,\nsince a hook that already refers to this flowtable can be already\nregistered, exposing this flowtable to packet path and nfnetlink_hook\ncontrol plane.\n\nThis error path is rare, it should only happen by reaching the maximum\nnumber hooks or by failing to set up to hardware offload, just call\nsynchronize_rcu().\n\nThere is a check for already used device hooks by different flowtable\nthat could result in EEXIST at this late stage. The hook parser can be\nupdated to perform this check earlier to this error path really becomes\nrarely exercised.\n\nUncovered by KASAN reported as use-after-free from nfnetlink_hook path\nwhen dumping hooks.\n\nFixes: 3b49e2e94e6e (\"netfilter: nf_tables: add flow table netlink frontend\")\nReported-by: Yiming Qian <yimingqian591@gmail.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\nSigned-off-by: Florian Westphal <fw@strlen.de>\n(backported from commit d73f4b53aaaea4c95f245e491aa5eeb8a21874ce)\n[tswhison: context adjustments due to missing commit\nd472e9853d7 (\"netfilter: nf_tables: register hooks last when adding new chain/flowtable\")]\nCVE-2026-23392\nSigned-off-by: Tim Whisonant <tim.whisonant@canonical.com>\n---\n net/netfilter/nf_tables_api.c | 1 +\n 1 file changed, 1 insertion(+)", "diff": "diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c\nindex 49fc22db42d62..cd4388bb00aef 100644\n--- a/net/netfilter/nf_tables_api.c\n+++ b/net/netfilter/nf_tables_api.c\n@@ -8123,6 +8123,7 @@ static int nf_tables_newflowtable(struct sk_buff *skb,\n \n \treturn 0;\n err5:\n+\tsynchronize_rcu();\n \tlist_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {\n \t\tnft_unregister_flowtable_hook(net, flowtable, hook);\n \t\tlist_del_rcu(&hook->list);\n", "prefixes": [ "SRU", "J", "1/1" ] }