From: Pablo Neira Ayuso Date: Tue, 16 May 2023 14:44:35 +0000 (+0200) Subject: netfilter: nf_tables: hold mutex on netns pre_exit path X-Git-Tag: baikal/aarch64/sdk5.10~51 X-Git-Url: https://git.baikalelectronics.ru/sdk/?a=commitdiff_plain;h=7eebd990ab5d085c7f25ace48869e9cc31168074;p=kernel.git netfilter: nf_tables: hold mutex on netns pre_exit path [ a669e8adb86a13fd522e3f4619d80500123fc268 ] clean_net() runs in workqueue while walking over the lists, grab mutex. Fixes: 815fac68e781 ("netfilter: nftables: fix possible UAF over chains from packet path in netns") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index e4eef4947cc75..909076ef157e8 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -7866,7 +7866,9 @@ static int __net_init nf_tables_init_net(struct net *net) static void __net_exit nf_tables_pre_exit_net(struct net *net) { + mutex_lock(&net->nft.commit_mutex); __nft_release_hooks(net); + mutex_unlock(&net->nft.commit_mutex); } static void __net_exit nf_tables_exit_net(struct net *net)