Re: [PATCH] netfilter: nf_log: clear per-net loggers on unregister

[Florian Westphal <fw@strlen.de>]

Chengfeng Ye <nicoyip.dev@gmail.com> wrote:
> Logger backends unregister their per-network namespace operations before
> unregistering their global logger. This leaves a window where a sysctl or
> netlink writer can rebind a per-net logger after the old per-net
> selection was cleared, but before the global logger registration is
> removed.
> 
> The race looks like this:
> 
>   CPU 0                                 CPU 1
>   ----                                  ----
>   unregister_pernet_subsys()
>     nf_log_unset(net, logger)
>       net->nf.nf_loggers[pf] = NULL
> 
>                                         lock nf_log_mutex
>                                         find logger in loggers[][]
>                                         net->nf.nf_loggers[pf] = logger
>                                         unlock nf_log_mutex
> Later, a sysctl read or nf_log_packet() reads net->nf.nf_loggers[pf]
> and dereferences the stale logger.
> 
> nf_log_unregister() only removes the backend from the global logger
> table. It does not clear matching net->nf.nf_loggers[] entries that were
> rebound by CPU 1 after per-net teardown. Once module unload completes,
> those per-net pointers can still reference static data from the unloaded
> logger backend, and later readers can dereference freed module memory.

Why can't this be fixed by unregistering in reverse order?