Re: [PATCH nf-next] netfilter: nft_set_rbtree: don't gc elements on insert

[Florian Westphal <fw@strlen.de>]

Florian Westphal <fw@strlen.de> wrote:
> During insertion we can queue up expired elements for garbage
> collection.

This fix is incorrect.

> +	/* Can GC when we rebuild the binary search blob. */
> +	if (time_after_eq(jiffies, priv->last_gc + nft_set_gc_interval(set)))
> +		nft_rbtree_gc(set);
> +

This posts elements via call_rcu.  But we don't hold rcu read lock.

cpu0					cpu1
  nft_rbtree_gc();
  call_rcu -> elements are free'd
					rcu_read_lock();
  					rcu_dereference(priv->array);

  rcu_replace_pointer();
					cpu1 operates on old blob, UaF.

nft_rbtree_gc() has to be split into
a scan phase and a reap phase, where scan phase unlinks and
relinks to the private list, and reaping happens after
the call to rcu_replace_pointer().

Sorry about this, I forgot call_rcu can fire instantly if there are
no readers.