[PATCH nf 0/5] netfilter: pin file with get_file_rcu() before reading f_cred

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

Since commit 0ede61d8589cc ("file: convert to SLAB_TYPESAFE_BY_RCU"),
struct file objects can have their slab slot reused while RCU readers
still hold pointers to them.

Five netfilter locations read file->f_cred through a stored sock->file
pointer under RCU without pinning the file. If the slab slot is
reused between the pointer read and the credential dereference, the
check operates on stale or unrelated credential data.

Pin the file with get_file_rcu() and release with fput() on all paths.

Tristan Madani (5):
  netfilter: xt_owner: pin file with get_file_rcu() before reading
    f_cred
  netfilter: nft_meta: pin file with get_file_rcu() before reading
    f_cred
  netfilter: nfnetlink_log: pin file with get_file_rcu() before reading
    f_cred
  netfilter: nfnetlink_queue: pin file with get_file_rcu() before
    reading f_cred
  netfilter: nf_log_syslog: pin file with get_file_rcu() before reading
    f_cred

 net/netfilter/nf_log_syslog.c   | 19 ++++++++++++-------
 net/netfilter/nfnetlink_log.c   | 17 +++++++++++------
 net/netfilter/nfnetlink_queue.c | 17 +++++++++++------
 net/netfilter/nft_meta.c        | 19 ++++++++++++-------
 net/netfilter/xt_owner.c        | 27 +++++++++++++++---------
 5 files changed, 64 insertions(+), 35 deletions(-)

-- 
2.47.3