Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.1/patches/2220996/?format=api
{ "id": 2220996, "url": "http://patchwork.ozlabs.org/api/1.1/patches/2220996/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260408163512.30537-6-fw@strlen.de/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/1.1/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null }, "msgid": "<20260408163512.30537-6-fw@strlen.de>", "date": "2026-04-08T16:35:10", "name": "[net,5/7] netfilter: nft_ct: fix use-after-free in timeout object destroy", "commit_ref": null, "pull_url": null, "state": "accepted", "archived": true, "hash": "b14cae92efbf121c4f95efe869936cfccf1b44d7", "submitter": { "id": 1025, "url": "http://patchwork.ozlabs.org/api/1.1/people/1025/?format=api", "name": "Florian Westphal", "email": "fw@strlen.de" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260408163512.30537-6-fw@strlen.de/mbox/", "series": [ { "id": 499159, "url": "http://patchwork.ozlabs.org/api/1.1/series/499159/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=499159", "date": "2026-04-08T16:35:05", "name": "[net,1/7] ipvs: fix NULL deref in ip_vs_add_service error path", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/499159/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2220996/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2220996/checks/", "tags": {}, "headers": { "Return-Path": "\n <netfilter-devel+bounces-11743-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11743-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=91.216.245.30", "smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=Chamillionaire.breakpoint.cc" ], "Received": [ "from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4frTKH6df7z1xv0\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 09 Apr 2026 02:38:43 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 42B7C30329A1\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 8 Apr 2026 16:35:41 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 2311B3D1706;\n\tWed, 8 Apr 2026 16:35:40 +0000 (UTC)", "from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc\n [91.216.245.30])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id A6DFC3A2579;\n\tWed, 8 Apr 2026 16:35:38 +0000 (UTC)", "by Chamillionaire.breakpoint.cc (Postfix, from userid 1003)\n\tid 0786A60560; Wed, 08 Apr 2026 18:35:37 +0200 (CEST)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1775666139; cv=none;\n b=FVdMHAxXfTeaxKKO4fpMOHu2Mq+5KetGRfbIFvvJK1Hk/KwPRiXOWYZJNJM+Hy3cSymxkzFC3YWwxuwg/pMu0x3UvPV3wNZl0LtcsOT7LP/5+iyHVgauX0NCjJi9uDvLQzDcaJGLMZG0oTCWRTMXBkaGbD4HoX0UEW2AWKDLr6Q=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1775666139; c=relaxed/simple;\n\tbh=5c50JljN0nyluFTWQSs1lEg6gg+uEZ2+0xi27FPAPNE=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=CJ1Fc/Vp9KiXP60GECNTJQVL/8LDwfrrJMKPQHSzo71jxMQBqeSNYhAfRigEduu2lo4q0owmSy2kour63OjnF91BTVIseUpwGzTRxiaEoUWaC3DWmgeUdLCQrYKwRrRsNcUBLR6vQGDNTaGnNGxictIsUoDVtYbIOysC/cDx0Kw=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de;\n spf=pass smtp.mailfrom=Chamillionaire.breakpoint.cc;\n arc=none smtp.client-ip=91.216.245.30", "From": "Florian Westphal <fw@strlen.de>", "To": "<netdev@vger.kernel.org>", "Cc": "Paolo Abeni <pabeni@redhat.com>,\n\t\"David S. Miller\" <davem@davemloft.net>,\n\tEric Dumazet <edumazet@google.com>,\n\tJakub Kicinski <kuba@kernel.org>,\n\t<netfilter-devel@vger.kernel.org>,\n\tpablo@netfilter.org", "Subject": "[PATCH net 5/7] netfilter: nft_ct: fix use-after-free in timeout\n object destroy", "Date": "Wed, 8 Apr 2026 18:35:10 +0200", "Message-ID": "<20260408163512.30537-6-fw@strlen.de>", "X-Mailer": "git-send-email 2.52.0", "In-Reply-To": "<20260408163512.30537-1-fw@strlen.de>", "References": "<20260408163512.30537-1-fw@strlen.de>", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "From: Tuan Do <tuan@calif.io>\n\nnft_ct_timeout_obj_destroy() frees the timeout object with kfree()\nimmediately after nf_ct_untimeout(), without waiting for an RCU grace\nperiod. Concurrent packet processing on other CPUs may still hold\nRCU-protected references to the timeout object obtained via\nrcu_dereference() in nf_ct_timeout_data().\n\nAdd an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer\nfreeing until after an RCU grace period, matching the approach already\nused in nfnetlink_cttimeout.c.\n\nKASAN report:\n BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0\n Read of size 4 at addr ffff8881035fe19c by task exploit/80\n\n Call Trace:\n nf_conntrack_tcp_packet+0x1381/0x29d0\n nf_conntrack_in+0x612/0x8b0\n nf_hook_slow+0x70/0x100\n __ip_local_out+0x1b2/0x210\n tcp_sendmsg_locked+0x722/0x1580\n __sys_sendto+0x2d8/0x320\n\n Allocated by task 75:\n nft_ct_timeout_obj_init+0xf6/0x290\n nft_obj_init+0x107/0x1b0\n nf_tables_newobj+0x680/0x9c0\n nfnetlink_rcv_batch+0xc29/0xe00\n\n Freed by task 26:\n nft_obj_destroy+0x3f/0xa0\n nf_tables_trans_destroy_work+0x51c/0x5c0\n process_one_work+0x2c4/0x5a0\n\nFixes: 7e0b2b57f01d (\"netfilter: nft_ct: add ct timeout support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Tuan Do <tuan@calif.io>\nSigned-off-by: Florian Westphal <fw@strlen.de>\n---\n include/net/netfilter/nf_conntrack_timeout.h | 1 +\n net/netfilter/nft_ct.c | 2 +-\n 2 files changed, 2 insertions(+), 1 deletion(-)", "diff": "diff --git a/include/net/netfilter/nf_conntrack_timeout.h b/include/net/netfilter/nf_conntrack_timeout.h\nindex 9fdaba911de6..3a66d4abb6d6 100644\n--- a/include/net/netfilter/nf_conntrack_timeout.h\n+++ b/include/net/netfilter/nf_conntrack_timeout.h\n@@ -14,6 +14,7 @@\n struct nf_ct_timeout {\n \t__u16\t\t\tl3num;\n \tconst struct nf_conntrack_l4proto *l4proto;\n+\tstruct rcu_head\t\trcu;\n \tchar\t\t\tdata[];\n };\n \ndiff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c\nindex 128ff8155b5d..04c74ccf9b84 100644\n--- a/net/netfilter/nft_ct.c\n+++ b/net/netfilter/nft_ct.c\n@@ -1020,7 +1020,7 @@ static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,\n \tnf_queue_nf_hook_drop(ctx->net);\n \tnf_ct_untimeout(ctx->net, timeout);\n \tnf_ct_netns_put(ctx->net, ctx->family);\n-\tkfree(priv->timeout);\n+\tkfree_rcu(priv->timeout, rcu);\n }\n \n static int nft_ct_timeout_obj_dump(struct sk_buff *skb,\n", "prefixes": [ "net", "5/7" ] }