Re: [PATCH request stable 6.12 6.6 6.1] netfilter: nf_tables_netdev_event UAF of binding chain

[Yu Junzhe <junzheyu1@gmail.com>]

Hello Greg,

The two upstream commits cherry-pick cleanly. They are Phil Sutter's
"Tolerate chains with no remaining hooks" (fc0133428e7a) and "Simplify
chain netdev notifier" (375f222800bc). The second is the follow-up that
makes list_for_each_entry() safe once the notifier no longer deletes the
base chain.

The 6.12 diff does not apply to 6.6 or 6.1: those trees still check
NETDEV_CHANGENAME in nf_tables_netdev_event(). So this is two series,
not one:

  [PATCH 6.12 1/2] and [PATCH 6.12 2/2]
  [PATCH 6.6 6.1 1/2] and [PATCH 6.6 6.1 2/2]

The 6.6 series applies cleanly on linux-6.1.y as well. Neither series
touches the rest of the netdev-hook rework.

Tested on KASAN guests, with the anonymous-jump ruleset from the
original report (base chain committed, then `nft add rule ... 'jump
{ accept; }'`, then `ip link del br0`):

  6.12.111  no slab-use-after-free in nf_tables_netdev_event
  6.6.157   no slab-use-after-free in nf_tables_netdev_event
  6.1.188   no slab-use-after-free in nf_tables_netdev_event

The same ruleset hits that KASAN bug on unpatched 6.6.144.

Thanks,
Yu Junzhe