[{"id":3684208,"web_url":"http://patchwork.ozlabs.org/comment/3684208/","msgid":"","list_archive_url":null,"date":"2026-04-29T18:17:12","subject":"Re: [PATCH 0/2] netfilter: fix NULL ops race in iptable lazy init","submitter":{"id":4285,"url":"http://patchwork.ozlabs.org/api/people/4285/","name":"Phil Sutter","email":"phil@nwl.cc"},"content":"Hi,\n\nOn Wed, Apr 29, 2026 at 05:56:10PM +0000, Tristan Madani wrote:\n> From: Tristan Madani \n> \n> ipt_register_table() and ip6t_register_table() call xt_register_table()\n> which adds the new table to the per-netns list, making it visible to\n> other code paths. Only afterwards do they allocate the per-net copy of\n> hook ops via kmemdup_array(). This leaves a window where the table is\n> findable via xt_find_table() but has ops=NULL.\n> \n> If cleanup_net runs during this window (racing namespace teardown against\n> lazy table init), ipt_unregister_table_pre_exit() /\n> ip6t_unregister_table_pre_exit() finds the table and passes the NULL ops\n> pointer to nf_unregister_net_hooks(), causing a general protection fault.\n> \n> Fix both ip_tables.c and ip6_tables.c by moving the ops allocation\n> before xt_register_table(), so the table is never in the list with a\n> NULL ops pointer.\n\nIs this true? Your patch moves the ops allocation, but new_table->ops is\nstill assigned after xt_register_table() has returned. AIUI, the race\nwindow is just reduced, not eliminated.\n\nFirst I thought you could assign to table->ops since xt_register_table()\ncalls kmemdup(), but 'table' is const.\n\nI guess checking table->ops value in *_pre_exit() is nonsense as well\nsince *_register_table() still runs in parallel. Do we need\nserialization between the two routines?\n\nCheers, Phil","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n unprotected) header.d=nwl.cc header.i=@nwl.cc header.a=rsa-sha256\n header.s=mail2022 header.b=E/YwELSc;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=172.105.105.114; helo=tor.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12304-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key)\n header.d=nwl.cc header.i=@nwl.cc header.b=\"E/YwELSc\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=151.80.46.58","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=nwl.cc","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=nwl.cc"],"Received":["from tor.lore.kernel.org (tor.lore.kernel.org [172.105.105.114])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g5QpS4HcTz1yHX\n\tfor ; Thu, 30 Apr 2026 04:30:24 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby tor.lore.kernel.org (Postfix) with ESMTP id DAC5630B7B5E\n\tfor ; Wed, 29 Apr 2026 18:24:50 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id A78EE42189A;\n\tWed, 29 Apr 2026 18:22:58 +0000 (UTC)","from orbyte.nwl.cc (orbyte.nwl.cc [151.80.46.58])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 087CD41B379;\n\tWed, 29 Apr 2026 18:22:55 +0000 (UTC)","from n0-1 by orbyte.nwl.cc with local (Exim 4.98.2)\n\t(envelope-from )\n\tid 1wI9TE-000000002Zv-2Qq1;\n\tWed, 29 Apr 2026 20:17:12 +0200"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1777486978; cv=none;\n b=s+pu1UbQgYwxLU2ZpO6TSat+ckAN5TAKUs5mLnvwyh60u5hvc+Yqmf/NDqiGyoKGllT8LNYJohiTf6fiDlxG0z6945FKsmgnoAFyqYSRuufNokpVJ90iDc5G94t500kULjFfFAtPArGxXqsqP9aDBN1ytwQ17luwKohbj5IRD9s=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1777486978; c=relaxed/simple;\n\tbh=pxBQFD3yB0Gs60ovsaXwB0grb9kcRUuCWUi5TwOVx3k=;\n\th=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:\n\t Content-Type:Content-Disposition:In-Reply-To;\n b=VyUVqRr9oMfVZyF3h6I5QW9AhgVxUIw2Lhj0BTuHgSavpcwgZggTmijqVtIp44G6/tGGBIfhQp49o5ca2aJbarZOVpTOj4/A5afRA/Bf6O7VZ4smlcTltBBOVZSapxvsmNTrS1TMdkRuZ/PccofuSzwwmCF6ov5C3NsB5mUUUD8=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=nwl.cc;\n spf=pass smtp.mailfrom=nwl.cc;\n dkim=pass (2048-bit key) header.d=nwl.cc header.i=@nwl.cc header.b=E/YwELSc;\n arc=none smtp.client-ip=151.80.46.58","DKIM-Signature":"v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=nwl.cc;\n\ts=mail2022; h=In-Reply-To:Content-Type:MIME-Version:References:Message-ID:\n\tSubject:Cc:To:From:Date:Sender:Reply-To:Content-Transfer-Encoding:Content-ID:\n\tContent-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc\n\t:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe:\n\tList-Post:List-Owner:List-Archive;\n\tbh=JIjFb8gPaZ6kuiayMq8XWinpuxhx075Z9YsnxLBDwpI=; b=E/YwELScW7aKXm7Cyz4kst3P9H\n\txqHlru3VzyZHf9l2aU8BCloTR+HE57Kv6SjDO+Lk0UQ8kv1mTjIzI73GWd4c5zk9Pf4pJjDYinkAZ\n\t2YNHEIcOuFzDYSFdwzM+2etRKeINi6wbQYQeVdvsQwz0sKipxzGCsx88zy7MdvVcUbFKHY1aIYgjW\n\txgOVRAOf936qnr273MxWYb21O8wRcAh0gPtB6sYrNusuIr55OIHsH0R8IvaFbuWtIhtD0XWAwWsbD\n\t1ZlLwNxOroAgdErVmLytu5mQGON+4Y7MdkW87LzfHqZfzRKEKTBM2N2vu+PC6FMqCUPcHYjtGgwJ7\n\tQzlDMWkg==;","Date":"Wed, 29 Apr 2026 20:17:12 +0200","From":"Phil Sutter ","To":"Tristan Madani ","Cc":"Pablo Neira Ayuso ,\n\tFlorian Westphal , netfilter-devel@vger.kernel.org,\n\tnetdev@vger.kernel.org, stable@vger.kernel.org,\n\tlinux-kernel@vger.kernel.org,\n\tTristan Madani ","Subject":"Re: [PATCH 0/2] netfilter: fix NULL ops race in iptable lazy init","Message-ID":"","References":"<20260429175613.1459342-1-tristmd@gmail.com>","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Type":"text/plain; charset=us-ascii","Content-Disposition":"inline","In-Reply-To":"<20260429175613.1459342-1-tristmd@gmail.com>"}},{"id":3684265,"web_url":"http://patchwork.ozlabs.org/comment/3684265/","msgid":"<177749662469.1430165.8044688741351868980@talencesecurity.com>","list_archive_url":null,"date":"2026-04-29T21:03:44","subject":"Re: [PATCH 0/2] netfilter: fix NULL ops race in iptable lazy init","submitter":{"id":93179,"url":"http://patchwork.ozlabs.org/api/people/93179/","name":"Tristan Madani","email":"tristmd@gmail.com"},"content":"On Wed, 30 Apr 2026 Phil Sutter wrote:\n> Is this true? Your patch moves the ops allocation, but new_table->ops is\n> still assigned after xt_register_table() has returned. AIUI, the race\n> window is just reduced, not eliminated.\n\nYou are right -- I missed that new_table->ops is assigned after\nxt_register_table() returns. The table becomes visible via list_add()\ninside xt_register_table(), but the ops pointer is still NULL at that\npoint. Moving the allocation alone does not close the window.\n\nWe cannot assign ops before xt_register_table() because we need the\nreturned new_table pointer to set ops[i].priv.\n\nWould a V2 that guards the pre_exit path instead be acceptable?\nSomething like:\n\n void ipt_unregister_table_pre_exit(struct net *net, const char *name)\n {\n \tstruct xt_table *table = xt_find_table(net, NFPROTO_IPV4, name);\n\n \tif (table && table->ops)\n \t\tnf_unregister_net_hooks(net, table->ops,\n \t\t\t\t hweight32(table->valid_hooks));\n }\n\nThis way cleanup_net simply skips the table if ops has not been assigned\nyet. The register path will either complete and call\nnf_register_net_hooks() normally, or fail and clean up via\n__ipt_unregister_table().\n\nThanks,\nTristan","headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=MVLDABHH;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=104.64.211.4; helo=sin.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12306-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=\"MVLDABHH\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=209.85.128.51","smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=gmail.com"],"Received":["from sin.lore.kernel.org (sin.lore.kernel.org [104.64.211.4])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g5VCb3l2Dz1yK1\n\tfor ; Thu, 30 Apr 2026 07:03:55 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sin.lore.kernel.org (Postfix) with ESMTP id AAA34300381B\n\tfor ; Wed, 29 Apr 2026 21:03:52 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 77AD83A7852;\n\tWed, 29 Apr 2026 21:03:50 +0000 (UTC)","from mail-wm1-f51.google.com (mail-wm1-f51.google.com\n [209.85.128.51])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id B892D36EAB9\n\tfor ; Wed, 29 Apr 2026 21:03:48 +0000 (UTC)","by mail-wm1-f51.google.com with SMTP id\n 5b1f17b1804b1-48334ee0aeaso1577385e9.1\n for ;\n Wed, 29 Apr 2026 14:03:48 -0700 (PDT)","from debian ([2001:41d0:303:db6b::])\n by smtp.gmail.com with ESMTPSA id\n 5b1f17b1804b1-48a822c832fsm29134635e9.10.2026.04.29.14.03.45\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Wed, 29 Apr 2026 14:03:45 -0700 (PDT)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1777496630; cv=none;\n b=atucqW9PjaM+eq8QL7KpIjS5rise2k8xGDC+jXFGKC8Ll//2ks+8gXa63JO9GsLx2+Xy+kUXgsreCAmfFrNSxHgl4v75IjFiQ4Y5vboYJmE4Fm96idpLEV6Wav7pLjvZIUuQbcm7yxGWSzlcsOcFovhBXmsfh7Kk1CYUGVWzxco=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1777496630; c=relaxed/simple;\n\tbh=2aA3uWTswagHEVLFA8v5skfAX/JT54EYEV9OQ+OofHQ=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t Content-Type:MIME-Version;\n b=Pnt6MLVfD2vMz3LpusH8QxHABv1j+5084Q0PuIpZrkD4H/XVzo2T0dKPMgP+5JockAebQ25hpf9xY1aLAGKo0oxN0yUOWPLOStDQALLpoUlwzBHf61sFwZRzjaq3xRAQY0vi0nj/DIsEpauGCb2JSgVIuLNnELfPM+jnxYTctnw=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com;\n spf=pass smtp.mailfrom=gmail.com;\n dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=MVLDABHH; arc=none smtp.client-ip=209.85.128.51","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1777496627; x=1778101427;\n darn=vger.kernel.org;\n h=mime-version:content-transfer-encoding:references:in-reply-to\n :message-id:date:subject:cc:to:from:from:to:cc:subject:date\n :message-id:reply-to;\n bh=9eaYTnlxpHCY09/j5CrSkFztBrg3e6wlR9rFliILkCQ=;\n b=MVLDABHH2s+wca68H4L+y5daBBNCnTUMhWl6HRklW6MSdEAY4a6yOrY5kF9H2KYkxy\n nMNeIbT2Bp9W649poDIzsnnBlgtFphG1BsOmUM7RBiqNYf9eo7Z6bYShIjfKQgNufM2J\n 1Tg61FURYlgeIfbFgNo8oKo1nzyRdmOqwVd2Ipzp4KKbZUVS+vR9elLc79ExJ/79Ijp2\n YDyL72gafLeamh7GrT0yuUYsnCdFACHI2ENscvafXVJsfrbQitd3Xgq5bME2LnQ1yAoh\n ob1NstAwBzNdtWtfzA09d5ECVRx+U5gXGcbSukpebnoPW1y8rFHisrwQ2v+LDiJ6g25D\n sqbw==","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1777496627; x=1778101427;\n h=mime-version:content-transfer-encoding:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=9eaYTnlxpHCY09/j5CrSkFztBrg3e6wlR9rFliILkCQ=;\n b=MHkXyJqwpeXbNE7wx4LQRC7br2h3lTDhkt4LvGlg1RSuDCYoMk7tBxQKnE1LaEsaU5\n I15kYrqaENVDEXTRSIlJ+yV0och2eIl4vx/CocMBk7M5SbIc/X7IxjNjwqYFBldmbat2\n M5kChh/B61cuKnEyLi93ZUqJSjlYVApupqKt7XEqjMHteIz6nc8JsbK71jrYU5eJeayk\n ia378CDfUrrrZRZCjA55x/7jy/3zhg82iInJ/Aaz43aRNe8Wh4tU+7PMgSA0TBInrSKp\n p9Lg3UtjYBTo6yy0ba7dp8dVhiSEtbnJ0+MbJuEuXQqhHmrvYbePthS9p843LbCGbjhN\n iWnQ==","X-Forwarded-Encrypted":"i=1;\n AFNElJ++AAPbfR8XKCqmvzrM+X4ESbLtHZuIwK5WoO3J6TVAaFhFbQepEKj6rwIH8s2X/2QNaKEnfY21ZizGk45OMAo=@vger.kernel.org","X-Gm-Message-State":"AOJu0Yz9wOaSw4Fo7iBi13BKYltQC9RYfFsCkk4JPOnuKIcqnLJudJDh\n\t1x9bXl3qzTYwzFy85jtnc/l1FVrwe26KrF2JzF35HTMZEbqbdB1C+6s=","X-Gm-Gg":"AeBDievN/es0k8/ML478pUbKPTw/nWdcuRN9X62k1dhk6kEP3YTS3lyWvE2aikRkuaQ\n\tvpedtg8JEzFMeKPdE8Dnw/X5mURBnCsOUv+EgD825JwtvPG3Qggi8O//02sucYmpPSA+h0KBn8y\n\tzr0nz9hiNPi9yp0cXrOXz0rrgGDDas9FQmSbAKpw1egBuud4uowArqnacJzVqOtOAhQrJ1n9vBh\n\t8aOY2TGas3SEYV5mjqZoOCtsHmz3YCCl90WAckzNwXowahaBPVdZOpoFOBqk2EIU8uxT9l2/Hdm\n\tLQFApP4Jw0VAhpEqr++VBhQqpSuATxXeMDaTfENmn75tlBo9npnjWoXOWNgaqEtfDshpTllhdkx\n\t9Az/ZRtUHOeiGp7LPfFk5X0cfG3Vh3tqJhFF7WOEM8h6w17JmUqc4kTtKS+mBcjIwUn4+MIM7KG\n\tD+L9tzR9nfMfmCug==","X-Received":"by 2002:a05:600c:350d:b0:48a:57e1:d8cc with SMTP id\n 5b1f17b1804b1-48a83e7055bmr3924695e9.9.1777496627067;\n Wed, 29 Apr 2026 14:03:47 -0700 (PDT)","From":"Tristan Madani ","X-Google-Original-From":"Tristan Madani ","To":"Phil Sutter ","Cc":"Pablo Neira Ayuso , Florian Westphal ,\n netfilter-devel@vger.kernel.org, netdev@vger.kernel.org,\n stable@vger.kernel.org, linux-kernel@vger.kernel.org","Subject":"Re: [PATCH 0/2] netfilter: fix NULL ops race in iptable lazy init","Date":"Wed, 29 Apr 2026 21:03:44 -0000","Message-ID":"<177749662469.1430165.8044688741351868980@talencesecurity.com>","In-Reply-To":"<20260429175613.1459342-1-tristmd@gmail.com>","References":"<20260429175613.1459342-1-tristmd@gmail.com>","Content-Type":"text/plain; charset=\"utf-8\"","Content-Transfer-Encoding":"7bit","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0"}}]