From bc9d0bae9c392f92db9ff1cb3420a4c6617fc9c3 Mon Sep 17 00:00:00 2001 From: Ziyang Xuan Date: Thu, 9 May 2024 11:56:55 +0800 Subject: [PATCH] netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() mainline inclusion from mainline-v6.9-rc5 commit d78d867dcea69c328db30df665be5be7d0148484 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L4T1 CVE: CVE-2024-27019 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d78d867dcea69c328db30df665be5be7d0148484 -------------------------------- nft_unregister_obj() can concurrent with __nft_obj_type_get(), and there is not any protection when iterate over nf_tables_objects list in __nft_obj_type_get(). Therefore, there is potential data-race of nf_tables_objects list entry. Use list_for_each_entry_rcu() to iterate over nf_tables_objects list in __nft_obj_type_get(), and use rcu_read_lock() in the caller nft_obj_type_get() to protect the entire type query process. Fixes: e50092404c1b ("netfilter: nf_tables: add stateful objects") Signed-off-by: Ziyang Xuan Signed-off-by: Pablo Neira Ayuso Conflicts: net/netfilter/nf_tables_api.c [The version does not include commit 776d45164844.] Signed-off-by: Ziyang Xuan --- net/netfilter/nf_tables_api.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 1cfd98d760604..6334e4303fde5 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -6197,7 +6197,7 @@ static const struct nft_object_type *__nft_obj_type_get(u32 objtype) { const struct nft_object_type *type; - list_for_each_entry(type, &nf_tables_objects, list) { + list_for_each_entry_rcu(type, &nf_tables_objects, list) { if (objtype == type->type) return type; } @@ -6209,9 +6209,13 @@ nft_obj_type_get(struct net *net, u32 objtype) { const struct nft_object_type *type; + rcu_read_lock(); type = __nft_obj_type_get(objtype); - if (type != NULL && try_module_get(type->owner)) + if (type != NULL && try_module_get(type->owner)) { + rcu_read_unlock(); return type; + } + rcu_read_unlock(); lockdep_nfnl_nft_mutex_not_held(); #ifdef CONFIG_MODULES -- Gitee