{"id":2220996,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2220996/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260408163512.30537-6-fw@strlen.de/","project":{"id":26,"url":"http://patchwork.ozlabs.org/api/1.1/projects/26/?format=json","name":"Netfilter Development","link_name":"netfilter-devel","list_id":"netfilter-devel.vger.kernel.org","list_email":"netfilter-devel@vger.kernel.org","web_url":null,"scm_url":null,"webscm_url":null},"msgid":"<20260408163512.30537-6-fw@strlen.de>","date":"2026-04-08T16:35:10","name":"[net,5/7] netfilter: nft_ct: fix use-after-free in timeout object destroy","commit_ref":null,"pull_url":null,"state":"accepted","archived":true,"hash":"b14cae92efbf121c4f95efe869936cfccf1b44d7","submitter":{"id":1025,"url":"http://patchwork.ozlabs.org/api/1.1/people/1025/?format=json","name":"Florian Westphal","email":"fw@strlen.de"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260408163512.30537-6-fw@strlen.de/mbox/","series":[{"id":499159,"url":"http://patchwork.ozlabs.org/api/1.1/series/499159/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=499159","date":"2026-04-08T16:35:05","name":"[net,1/7] ipvs: fix NULL deref in ip_vs_add_service error path","version":1,"mbox":"http://patchwork.ozlabs.org/series/499159/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2220996/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2220996/checks/","tags":{},"headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11743-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=91.216.245.30","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=Chamillionaire.breakpoint.cc"],"Received":["from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4frTKH6df7z1xv0\n\tfor ; Thu, 09 Apr 2026 02:38:43 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 42B7C30329A1\n\tfor ; Wed, 8 Apr 2026 16:35:41 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 2311B3D1706;\n\tWed, 8 Apr 2026 16:35:40 +0000 (UTC)","from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc\n [91.216.245.30])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id A6DFC3A2579;\n\tWed, 8 Apr 2026 16:35:38 +0000 (UTC)","by Chamillionaire.breakpoint.cc (Postfix, from userid 1003)\n\tid 0786A60560; Wed, 08 Apr 2026 18:35:37 +0200 (CEST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1775666139; cv=none;\n b=FVdMHAxXfTeaxKKO4fpMOHu2Mq+5KetGRfbIFvvJK1Hk/KwPRiXOWYZJNJM+Hy3cSymxkzFC3YWwxuwg/pMu0x3UvPV3wNZl0LtcsOT7LP/5+iyHVgauX0NCjJi9uDvLQzDcaJGLMZG0oTCWRTMXBkaGbD4HoX0UEW2AWKDLr6Q=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1775666139; c=relaxed/simple;\n\tbh=5c50JljN0nyluFTWQSs1lEg6gg+uEZ2+0xi27FPAPNE=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=CJ1Fc/Vp9KiXP60GECNTJQVL/8LDwfrrJMKPQHSzo71jxMQBqeSNYhAfRigEduu2lo4q0owmSy2kour63OjnF91BTVIseUpwGzTRxiaEoUWaC3DWmgeUdLCQrYKwRrRsNcUBLR6vQGDNTaGnNGxictIsUoDVtYbIOysC/cDx0Kw=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=strlen.de;\n spf=pass smtp.mailfrom=Chamillionaire.breakpoint.cc;\n arc=none smtp.client-ip=91.216.245.30","From":"Florian Westphal ","To":"","Cc":"Paolo Abeni ,\n\t\"David S. Miller\" ,\n\tEric Dumazet ,\n\tJakub Kicinski ,\n\t,\n\tpablo@netfilter.org","Subject":"[PATCH net 5/7] netfilter: nft_ct: fix use-after-free in timeout\n object destroy","Date":"Wed, 8 Apr 2026 18:35:10 +0200","Message-ID":"<20260408163512.30537-6-fw@strlen.de>","X-Mailer":"git-send-email 2.52.0","In-Reply-To":"<20260408163512.30537-1-fw@strlen.de>","References":"<20260408163512.30537-1-fw@strlen.de>","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit"},"content":"From: Tuan Do \n\nnft_ct_timeout_obj_destroy() frees the timeout object with kfree()\nimmediately after nf_ct_untimeout(), without waiting for an RCU grace\nperiod. Concurrent packet processing on other CPUs may still hold\nRCU-protected references to the timeout object obtained via\nrcu_dereference() in nf_ct_timeout_data().\n\nAdd an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer\nfreeing until after an RCU grace period, matching the approach already\nused in nfnetlink_cttimeout.c.\n\nKASAN report:\n BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0\n Read of size 4 at addr ffff8881035fe19c by task exploit/80\n\n Call Trace:\n nf_conntrack_tcp_packet+0x1381/0x29d0\n nf_conntrack_in+0x612/0x8b0\n nf_hook_slow+0x70/0x100\n __ip_local_out+0x1b2/0x210\n tcp_sendmsg_locked+0x722/0x1580\n __sys_sendto+0x2d8/0x320\n\n Allocated by task 75:\n nft_ct_timeout_obj_init+0xf6/0x290\n nft_obj_init+0x107/0x1b0\n nf_tables_newobj+0x680/0x9c0\n nfnetlink_rcv_batch+0xc29/0xe00\n\n Freed by task 26:\n nft_obj_destroy+0x3f/0xa0\n nf_tables_trans_destroy_work+0x51c/0x5c0\n process_one_work+0x2c4/0x5a0\n\nFixes: 7e0b2b57f01d (\"netfilter: nft_ct: add ct timeout support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Tuan Do \nSigned-off-by: Florian Westphal \n---\n include/net/netfilter/nf_conntrack_timeout.h | 1 +\n net/netfilter/nft_ct.c | 2 +-\n 2 files changed, 2 insertions(+), 1 deletion(-)","diff":"diff --git a/include/net/netfilter/nf_conntrack_timeout.h b/include/net/netfilter/nf_conntrack_timeout.h\nindex 9fdaba911de6..3a66d4abb6d6 100644\n--- a/include/net/netfilter/nf_conntrack_timeout.h\n+++ b/include/net/netfilter/nf_conntrack_timeout.h\n@@ -14,6 +14,7 @@\n struct nf_ct_timeout {\n \t__u16\t\t\tl3num;\n \tconst struct nf_conntrack_l4proto *l4proto;\n+\tstruct rcu_head\t\trcu;\n \tchar\t\t\tdata[];\n };\n \ndiff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c\nindex 128ff8155b5d..04c74ccf9b84 100644\n--- a/net/netfilter/nft_ct.c\n+++ b/net/netfilter/nft_ct.c\n@@ -1020,7 +1020,7 @@ static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx,\n \tnf_queue_nf_hook_drop(ctx->net);\n \tnf_ct_untimeout(ctx->net, timeout);\n \tnf_ct_netns_put(ctx->net, ctx->family);\n-\tkfree(priv->timeout);\n+\tkfree_rcu(priv->timeout, rcu);\n }\n \n static int nft_ct_timeout_obj_dump(struct sk_buff *skb,\n","prefixes":["net","5/7"]}