From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: mingqian591@gmail.com
Subject: Re: [PATCH nf] netfilter: nf_tables: release flowtable after rcu grace period on error
Date: Tue, 17 Mar 2026 19:20:37 +0100 [thread overview]
Message-ID: <abmbdQX2u-837rpj@chamomile> (raw)
In-Reply-To: <20260317175952.26821-1-pablo@netfilter.org>
On Tue, Mar 17, 2026 at 06:59:52PM +0100, Pablo Neira Ayuso wrote:
> Use kfree_rcu() to release flowtable from error path, since a hook that
> already refers to this flowtable can be already registered, exposing
> this flowtable to packet path and nfnetlink_hook control plane.
>
> Uncovered by KASAN reported as use-after-free from nfnetlink_hook path
> when dumping hooks.
>
> The number of flowtable objects in a ruleset are expected to be small,
> the increment is memory consumption should be negligible. In older
> kernels, users could mistype device names leading to this error path,
> I prefer struct rcu_head here instead of explicit synchronize_rcu()
> call.
Scratch this, I will post v2, flowtable->name is also released
inmediately, this needs to happen after rcu grace period.
prev parent reply other threads:[~2026-03-17 18:20 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-17 17:59 [PATCH nf] netfilter: nf_tables: release flowtable after rcu grace period on error Pablo Neira Ayuso
2026-03-17 18:20 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=abmbdQX2u-837rpj@chamomile \
--to=pablo@netfilter.org \
--cc=mingqian591@gmail.com \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.