Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b09e6ccf authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Greg Kroah-Hartman
Browse files

netfilter: nf_tables: double hook unregistration in netns path 



commit f9a43007d3f7ba76d5e7f9421094f00f2ef202f8 upstream.

__nft_release_hooks() is called from pre_netns exit path which
unregisters the hooks, then the NETDEV_UNREGISTER event is triggered
which unregisters the hooks again.

[  565.221461] WARNING: CPU: 18 PID: 193 at net/netfilter/core.c:495 __nf_unregister_net_hook+0x247/0x270
[...]
[  565.246890] CPU: 18 PID: 193 Comm: kworker/u64:1 Tainted: G            E     5.18.0-rc7+ #27
[  565.253682] Workqueue: netns cleanup_net
[  565.257059] RIP: 0010:__nf_unregister_net_hook+0x247/0x270
[...]
[  565.297120] Call Trace:
[  565.300900]  <TASK>
[  565.304683]  nf_tables_flowtable_event+0x16a/0x220 [nf_tables]
[  565.308518]  raw_notifier_call_chain+0x63/0x80
[  565.312386]  unregister_netdevice_many+0x54f/0xb50

Unregister and destroy netdev hook from netns pre_exit via kfree_rcu
so the NETDEV_UNREGISTER path see unregistered hooks.

Fixes: 767d1216bff8 ("netfilter: nftables: fix possible UAF over chains from packet path in netns")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b05a24cc

net/netfilter/nf_tables_api.c

+27 −7
Original line number Diff line number Diff line
@@ -219,9 +219,10 @@ static int nf_tables_register_hook(struct net *net, 
	return nf_register_net_hook(net, ops);

}



static void nf_tables_unregister_hook(struct net *net,

static void __nf_tables_unregister_hook(struct net *net,

					const struct nft_table *table,

				      struct nft_chain *chain)

					struct nft_chain *chain,

					bool release_netdev)

{

	const struct nft_base_chain *basechain;

	const struct nf_hook_ops *ops;
@@ -236,6 +237,16 @@ static void nf_tables_unregister_hook(struct net *net, 
		return basechain->type->ops_unregister(net, ops);



	nf_unregister_net_hook(net, ops);

	if (release_netdev &&

	    table->family == NFPROTO_NETDEV)

		nft_base_chain(chain)->ops.dev = NULL;

}



static void nf_tables_unregister_hook(struct net *net,

				      const struct nft_table *table,

				      struct nft_chain *chain)

{

	__nf_tables_unregister_hook(net, table, chain, false);

}



static int nft_trans_table_add(struct nft_ctx *ctx, int msg_type)
@@ -5997,8 +6008,9 @@ nft_flowtable_type_get(struct net *net, u8 family) 
	return ERR_PTR(-ENOENT);

}



static void nft_unregister_flowtable_net_hooks(struct net *net,

					       struct nft_flowtable *flowtable)

static void __nft_unregister_flowtable_net_hooks(struct net *net,

						 struct nft_flowtable *flowtable,

						 bool release_netdev)

{

	int i;
@@ -6007,9 +6019,17 @@ static void nft_unregister_flowtable_net_hooks(struct net *net, 
			continue;



		nf_unregister_net_hook(net, &flowtable->ops[i]);

		if (release_netdev)

			flowtable->ops[i].dev = NULL;

	}

}



static void nft_unregister_flowtable_net_hooks(struct net *net,

					       struct nft_flowtable *flowtable)

{

	__nft_unregister_flowtable_net_hooks(net, flowtable, false);

}



static int nf_tables_newflowtable(struct net *net, struct sock *nlsk,

				  struct sk_buff *skb,

				  const struct nlmsghdr *nlh,
@@ -8192,9 +8212,9 @@ static void __nft_release_hook(struct net *net, struct nft_table *table) 
	struct nft_chain *chain;



	list_for_each_entry(chain, &table->chains, list)

		nf_tables_unregister_hook(net, table, chain);

		__nf_tables_unregister_hook(net, table, chain, true);

	list_for_each_entry(flowtable, &table->flowtables, list)

		nft_unregister_flowtable_net_hooks(net, flowtable);

		__nft_unregister_flowtable_net_hooks(net, flowtable, true);

}



static void __nft_release_hooks(struct net *net)

net/netfilter/nft_chain_filter.c

+3 −0
Original line number Diff line number Diff line
@@ -296,6 +296,9 @@ static void nft_netdev_event(unsigned long event, struct net_device *dev, 
		if (strcmp(basechain->dev_name, dev->name) != 0)

			return;



		if (!basechain->ops.dev)

			return;



		/* UNREGISTER events are also happpening on netns exit.

		 *

		 * Altough nf_tables core releases all tables/chains, only