Re: [PATCH] netfilter: nf_tables: always synchronize with readers before releasing tables

[Florian Westphal <fw@strlen.de>]

Alexander Atanasov <alexander.atanasov@virtuozzo.com> wrote:
> On 28.02.23 1:31, Florian Westphal wrote:
> > Alexander Atanasov <alexander.atanasov@virtuozzo.com> wrote:
> > > As i said i am still trying to figure out the basechain place,
> > > where is that synchronize_rcu() call done?
> > 
> > cleanup_net() in net/core/net_namespace.c.
> > 
> > pre_exit handlers run, then synchronize_rcu, then the
> > normal exit handlers, then exit_batch.
> 
> It prevents anyone new to find the namespace but it does not guard against
> the ones that have already found it.

The netns is being dismantled, how can there be any process left?

> What stops them to enter a rcu_read_lock() section after the synchronize
> call in cleanup_net() is done and race with the exit handler?

There should be no task in the first place.

> synchronize_rcu() must be called with the commit_mutex held to be safe
> against lock less readers using data protected with commit_mutext.

Sorry, I do not understand this bug nor the fix.