Re: [PATCH nf] netfilter: nftables: skip netdev events generated on netns removal

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Oct 06, 2021 at 04:20:34PM +0200, Florian Westphal wrote:
> syzbot reported following (harmless) WARN:
> 
>  WARNING: CPU: 1 PID: 2648 at net/netfilter/core.c:468
>   nft_netdev_unregister_hooks net/netfilter/nf_tables_api.c:230 [inline]
>   nf_tables_unregister_hook include/net/netfilter/nf_tables.h:1090 [inline]
>   __nft_release_basechain+0x138/0x640 net/netfilter/nf_tables_api.c:9524
>   nft_netdev_event net/netfilter/nft_chain_filter.c:351 [inline]
>   nf_tables_netdev_event+0x521/0x8a0 net/netfilter/nft_chain_filter.c:382
> 
> reproducer:
> unshare -n bash -c 'ip link add br0 type bridge; nft add table netdev t ; \
>  nft add chain netdev t ingress \{ type filter hook ingress device "br0" \
>  priority 0\; policy drop\; \}'
> 
> Problem is that when netns device exit hooks create the UNREGISTER
> event, the .pre_exit hook for nf_tables core has already removed the
> base hook.  Notifier attempts to do this again.
> 
> The need to do base hook unregister unconditionally was needed in the past,
> because notifier was last stage where reg->dev dereference was safe.
> 
> Now that nf_tables does the hook removal in .pre_exit, this isn't
> needed anymore.

Applied, thanks.