From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6C24A4E73A4 for ; Tue, 13 Oct 2026 23:43:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.45 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791935029; cv=none; b=Tk7Yix/tbdIyTyKLt709uVuOSifdSC2RQMn4vSqpf6U07gic3cg/WFy8wbVbVNIe8b0YbxRar9ztc6Ned5DH7cwL0u87zyYeqESikhw+1c1vZzUaVibWjnNTlWHwspxZCZRl0XMy8G52Xeh8KuBafNcphy/bvjYe8rCJDOx7NpM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791935029; c=relaxed/simple; bh=tQhRPjbpm5bw4SJApOkVBgcnuTmGSv7bVfdhlLbwMOE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Vp+O++sxxK3kQy1GDrbITL00fwKr0vF2WGU9rcG0AYOwZWtqXaBn3F/Qx3hS4uFLILvqLbzQhZ5pfBqhOJhYoOJdEAvjOLEHNY7YLEPzJDJezUCb9APwT9LtadGOqvfyxWJnOv7d20MpiEPSlEFNgE08Vv7trrioiXw4JREO0AY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=fsrCH3MP; arc=none smtp.client-ip=209.85.128.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="fsrCH3MP" Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-49d05d51553so2445385e9.2 for ; Tue, 13 Oct 2026 16:43:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791935025; x=1792539825; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=XrQ3pYkWsUkZm6c4Y630wMw1ofCmIUu+ku1D5bRsOSA=; b=fsrCH3MP+GxQaUmiEtAr5f+U/ctPY1nWGDo7rDt0uK1GeqXyJV6v+49m6Kcppvg1Q0 4U2TN9Z6//DS1UtlX9mQ0Bn1enQv8y4y033w+EJmh4xux9S45z/rd7KosFKCvlR4dIYG zXpGFSTETBubQLZHZTqa4tC5moV9gEP0DI/KoU38LSiP9g2FVHEpRDQqMV2f2VCAOcFS uy7xKY4qclTqrm0he22CUGrInJf/rHLXm4G/Lz6Jdr6kNkTrJ7JwII2QDvZKczhMtXKa yaVRQQk+Kw04S8lhUlVu8pQPm/VisQeG4mAi7Y8wyw5Ug7b+xSN3sk2ac2Do69ewBuBe chMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791935025; x=1792539825; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=XrQ3pYkWsUkZm6c4Y630wMw1ofCmIUu+ku1D5bRsOSA=; b=0PztE6J/ByXJmcVDsmwAfdSXaDyzhOxSIMMdfHl0A+DbavOQ0WrtjcE7yImS9uEfC0 6MPtpmjTcFyVxJ2WxbAv2eIjl/qwlBui8bgC1QDZzQlaYuXz1cZ43AhdDqWHDHFux1eG 4TZWgkdhTc1iZKHHRM1JV4+q076WfZpW4dcWhHCpsAJB3fgX6x3tPODlO9HlB/YCgjvt g3Rd7Ebbm5jXXBKMyApCc2x2R0wfUzE9+fF9mXoHRxqSC+9/151ctQBQ6nXebLwypumd q0fjUP54q7UURV9OIVNKpKB7/G018Hv3gh7kg8fmQMTvQ0ODDabw0cF4gAolc19hgic2 jMXQ== X-Forwarded-Encrypted: i=1; AKwUvBzFujpGqjUKQNJH7ApKEtFwlIGxDhAvyUQtx6TXBCmkRSvtWJg8U3wLbsyPRm329tKIlNik8J0=@vger.kernel.org X-Gm-Message-State: AFq9FYJBdNlry01hzYWa3jxxnhs914vLsV5W+70UL08Tz9ee852Z3G+Z ui1XWg6RlCGCHJ+Ub8+MriTdkGANNTTQNEJCQt/YBlWPzXi44UDGu08= X-Gm-Gg: AYBFou14zU062lBsTOneb7TwpDlS42DL3OrhLEeE11ltd7hblvT10wjtf7WIZe0nQ3j u/UTzGBCeF0+ir+ih8kbW4XCEJyVYB7AJBX1NHq3QRrIZaeZP1Q+sutN+DFQq8qb9T6lNbre6Jw MwaVAb3Nf2Kp+oIifVHfEy9A1bQ3wuWJ207U/NF4sTSz4/HR0syV+x/lJxhUZhdIKa2wDlxMIZm PWo8am3r7uOw4f6LNkGDHmeqe09do5dzGxezgpe50olwubbIf5Ze+pukpH2WdyGgn3WbXtxbQVH zxMongbX6dNA37aS/o0lzkLupujH7up53RP1aDMTA9PiPzb+QhVGvQBNPyFBWjSt1K01mImwE8B 648F5SYnQe5BIFYi+DdorzyNJhcqKH6Mzjxvclx8oCY1HDbQXylJIl5v0fS1V1gcCdFkZdddhlS gs0TT60jJfVot4/onVxmbVyq+sy+oQ2n/Te76YTq4= X-Received: by 2002:a05:600c:699b:b0:4a0:4a8:d444 with SMTP id 5b1f17b1804b1-4a18e4af334mr291263645e9.33.1791935024497; Tue, 13 Oct 2026 16:43:44 -0700 (PDT) Received: from debian.. ([2001:41d0:303:db6b::]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a18bf35930sm390372155e9.13.2026.10.13.16.43.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 13 Oct 2026 16:43:43 -0700 (PDT) From: Tristan Madani To: Pablo Neira Ayuso , Florian Westphal Cc: Phil Sutter , Christian Brauner , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, Tristan Madani , stable@vger.kernel.org Subject: [PATCH nf 5/5] netfilter: nf_log_syslog: pin file with get_file_rcu() before reading f_cred Date: Tue, 13 Oct 2026 23:43:28 +0000 Message-ID: <20261013234329.2797868-6-tristmd@gmail.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261013234329.2797868-1-tristmd@gmail.com> References: <20261013234329.2797868-1-tristmd@gmail.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Tristan Madani Since commit 0ede61d8589cc ("file: convert to SLAB_TYPESAFE_BY_RCU"), struct file objects can have their slab slot reused while RCU readers still hold pointers to them. The syslog UID/GID output reads file->f_cred without pinning the file, which could lead to logging credentials from an unrelated file if the slab slot is reused. Use get_file_rcu() to take a reference on the file before reading credentials, and fput() to release it after extracting the values. Fixes: 0ede61d8589cc ("file: convert to SLAB_TYPESAFE_BY_RCU") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- net/netfilter/nf_log_syslog.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/net/netfilter/nf_log_syslog.c b/net/netfilter/nf_log_syslog.c index c3fd398ffcd77..f41bf83190912 100644 --- a/net/netfilter/nf_log_syslog.c +++ b/net/netfilter/nf_log_syslog.c @@ -168,22 +168,27 @@ static struct nf_logger nf_arp_logger __read_mostly = { static void nf_log_dump_sk_uid_gid(struct net *net, struct nf_log_buf *m, struct sock *sk) { - const struct socket *sock; - const struct file *file; + struct socket *sock; + struct file *file; if (!sk || !sk_fullsock(sk) || !net_eq(net, sock_net(sk))) return; - /* The sk pointer remains valid as long as the skb is. The sk_socket and - * file pointer may become NULL if the socket is closed. Both structures - * (including file->cred) are RCU freed which means they can be accessed - * within a RCU read section. + /* The sk pointer remains valid as long as the skb is. The + * sk_socket and file pointer may become NULL if the socket is + * closed. Since struct file uses SLAB_TYPESAFE_BY_RCU, pin the + * file with get_file_rcu() to ensure f_cred is not from a + * reused slab slot. */ sock = READ_ONCE(sk->sk_socket); - file = sock ? READ_ONCE(sock->file) : NULL; + if (sock) + file = get_file_rcu(&sock->file); + else + file = NULL; if (file) { const struct cred *cred = file->f_cred; + fput(file); nf_log_buf_add(m, "UID=%u GID=%u ", from_kuid_munged(&init_user_ns, cred->fsuid), from_kgid_munged(&init_user_ns, cred->fsgid)); -- 2.47.3