[PATCH request stable 6.12 6.6 6.1] netfilter: nf_tables_netdev_event UAF of binding chain

[Yu Junzhe <junzheyu1@gmail.com>]

Hello,

Please consider a backport of the following use-after-free to the
longterm trees that still have it: 6.12, 6.6, and 6.1. 6.18 and newer
are not affected.

There is no single upstream commit to cherry-pick. On current linux.git
the netdev notifier no longer calls __nft_release_basechain(); it only
unregisters the per-device hook. That change arrived as part of the
netdev-hook rework and does not apply to these stable trees.

Bug
===

nf_tables_netdev_event() walks table->chains with
list_for_each_entry_safe. On NETDEV_UNREGISTER of the last hook,
nft_netdev_event() calls __nft_release_basechain(). Releasing the base
chain deactivates a JUMP to an NFT_CHAIN_BINDING chain, which
nft_chain_del()s that successor and nft_immediate_destroy() kfree()s
it. The walker's saved nr still points at the freed nft_chain.

Still present in:

  linux-6.12.y  (6.12.111)  nft_chain_filter.c: __nft_release_basechain()
  linux-6.6.y   (6.6.157)
  linux-6.1.y   (6.1.188)

Gone in linux-6.18.y and linux-7.0.y.

Reproducer (nftables 1.0.9)
===========================

An anonymous jump is what sets NFT_CHAIN_BINDING (chain flags 0x4).
Commit the base chain first, then add the jump in a second command.
Chains are appended to table->chains, and the walker frees the chain
that follows the base chain. One nft -f that contains both creates the
binding chain first and does not hit this path.

  ip link add br0 type bridge
  ip link set br0 up
  nft -f - <<'EOF'
  table netdev t {
          chain in {
                  type filter hook ingress device "br0" priority 0; policy accept;
          }
  }
  EOF
  nft add rule netdev t in 'jump { accept; }'
  ip link del br0

The namespace must still be alive. Netns teardown is too late: nft
pernet exit wins that race. Needs CAP_NET_ADMIN. Do not run on a host
kernel.

Confirmed on Linux 6.6.144 KASAN (same __nft_release_basechain() walk
as 6.6.y and 6.12.y). I have not booted 6.12.111 or 6.1.188.

  BUG: KASAN: slab-use-after-free in nf_tables_netdev_event+0x635/0x970
  Read of size 8 at addr ff110000037faa20 by task ip/229
  Freed by task 229:
    nft_immediate_destroy
    __nft_release_basechain_now
    __nft_release_basechain
    nf_tables_netdev_event

The read is 8 bytes at offset 32 of a kmalloc-128 object
(nft_chain.list).

Thanks,
Yu Junzhe
FuzzAnything <fuzzanything@gmail.com>