Re: [PATCH nf] netfilter: ipt_CLUSTERIP: fix use-after-free of proc entry

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Jul 19, 2017 at 12:29:58PM +1200, Xin Long wrote:
> On Wed, Jul 19, 2017 at 12:56 AM, Sabrina Dubroca <sd@queasysnail.net> wrote:
> > When we delete a netns with a CLUSTERIP rule, clusterip_net_exit() is
> > called first, removing /proc/net/ipt_CLUSTERIP.
> > Then clusterip_config_entry_put() is called from clusterip_tg_destroy(),
> > and tries to remove its entry under /proc/net/ipt_CLUSTERIP/.
> >
> > Fix this by checking that the parent directory of the entry to remove
> > hasn't already been deleted.
> >
> > The following triggers a KASAN splat (stealing the reproducer from
> > 202f59afd441, thanks to Jianlin Shi and Xin Long):
> >
> >     ip netns add test
> >     ip link add veth0_in type veth peer name veth0_out
> >     ip link set veth0_in netns test
> >     ip netns exec test ip link set lo up
> >     ip netns exec test ip link set veth0_in up
> >     ip netns exec test iptables -I INPUT -d 1.2.3.4 -i veth0_in -j     \
> >         CLUSTERIP --new --clustermac 89:d4:47:eb:9a:fa --total-nodes 3 \
> >         --local-node 1 --hashmode sourceip-sourceport
> >     ip netns del test
> >
> > Fixes: ce4ff76c15a8 ("netfilter: ipt_CLUSTERIP: make proc directory per net namespace")
> > Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
> 
> Reviewed-by: Xin Long <lucien.xin@gmail.com>

Applied, thanks.