diff mbox series

[net,1/7] netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()

Message ID 20240411112900.129414-2-pablo@netfilter.org
State Accepted
Headers show
Series [net,1/7] netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() | expand

Commit Message

Pablo Neira Ayuso April 11, 2024, 11:28 a.m. UTC 
From: Ziyang Xuan <william.xuanziyang@huawei.com>

nft_unregister_expr() can concurrent with __nft_expr_type_get(),
and there is not any protection when iterate over nf_tables_expressions
list in __nft_expr_type_get(). Therefore, there is potential data-race
of nf_tables_expressions list entry.

Use list_for_each_entry_rcu() to iterate over nf_tables_expressions
list in __nft_expr_type_get(), and use rcu_read_lock() in the caller
nft_expr_type_get() to protect the entire type query process.

Fixes: ef1f7df9170d ("netfilter: nf_tables: expression ops overloading")
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_tables_api.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

Comments

patchwork-bot+netdevbpf@kernel.org April 12, 2024, 12:10 p.m. UTC | #1 
Hello:

This series was applied to netdev/net.git (main)
by Pablo Neira Ayuso <pablo@netfilter.org>:

On Thu, 11 Apr 2024 13:28:54 +0200 you wrote:
> From: Ziyang Xuan <william.xuanziyang@huawei.com>
> 
> nft_unregister_expr() can concurrent with __nft_expr_type_get(),
> and there is not any protection when iterate over nf_tables_expressions
> list in __nft_expr_type_get(). Therefore, there is potential data-race
> of nf_tables_expressions list entry.
> 
> [...]

Here is the summary with links:
  - [net,1/7] netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
    https://git.kernel.org/netdev/net/c/f969eb84ce48
  - [net,2/7] netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
    https://git.kernel.org/netdev/net/c/d78d867dcea6
  - [net,3/7] netfilter: br_netfilter: skip conntrack input hook for promisc packets
    https://git.kernel.org/netdev/net/c/751de2012eaf
  - [net,4/7] netfilter: nft_set_pipapo: walk over current view on netlink dump
    https://git.kernel.org/netdev/net/c/29b359cf6d95
  - [net,5/7] netfilter: nft_set_pipapo: do not free live element
    https://git.kernel.org/netdev/net/c/3cfc9ec039af
  - [net,6/7] netfilter: flowtable: validate pppoe header
    https://git.kernel.org/netdev/net/c/87b3593bed18
  - [net,7/7] netfilter: flowtable: incorrect pppoe tuple
    https://git.kernel.org/netdev/net/c/6db5dc7b351b

You are awesome, thank you!
diff mbox series

Patch

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index d89d77946719..53b8c00863ad 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3060,7 +3060,7 @@  static const struct nft_expr_type *__nft_expr_type_get(u8 family,
 {
 	const struct nft_expr_type *type, *candidate = NULL;
 
-	list_for_each_entry(type, &nf_tables_expressions, list) {
+	list_for_each_entry_rcu(type, &nf_tables_expressions, list) {
 		if (!nla_strcmp(nla, type->name)) {
 			if (!type->family && !candidate)
 				candidate = type;
@@ -3092,9 +3092,13 @@  static const struct nft_expr_type *nft_expr_type_get(struct net *net,
 	if (nla == NULL)
 		return ERR_PTR(-EINVAL);
 
+	rcu_read_lock();
 	type = __nft_expr_type_get(family, nla);
-	if (type != NULL && try_module_get(type->owner))
+	if (type != NULL && try_module_get(type->owner)) {
+		rcu_read_unlock();
 		return type;
+	}
+	rcu_read_unlock();
 
 	lockdep_nfnl_nft_mutex_not_held();
 #ifdef CONFIG_MODULES