From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH nf] netfilter: nf_tables: always release netdev hooks from notifier
Date: Wed, 10 May 2023 08:32:22 +0200 [thread overview]
Message-ID: <ZFs6drN7cVJ2UQYy@calendula> (raw)
In-Reply-To: <20230504122021.21058-1-fw@strlen.de>
On Thu, May 04, 2023 at 02:20:21PM +0200, Florian Westphal wrote:
> This reverts "netfilter: nf_tables: skip netdev events generated on netns removal".
>
> The problem is that when a veth device is released, the veth release
> callback will also queue the peer netns device for removal.
>
> Its possible that the peer netns is also slated for removal. In this
> case, the device memory is already released before the pre_exit hook of
> the peer netns runs:
>
> BUG: KASAN: slab-use-after-free in nf_hook_entry_head+0x1b8/0x1d0
> Read of size 8 at addr ffff88812c0124f0 by task kworker/u8:1/45
> Workqueue: netns cleanup_net
> Call Trace:
> nf_hook_entry_head+0x1b8/0x1d0
> __nf_unregister_net_hook+0x76/0x510
> nft_netdev_unregister_hooks+0xa0/0x220
> __nft_release_hook+0x184/0x490
> nf_tables_pre_exit_net+0x12f/0x1b0
> ..
>
> Order is:
> 1. First netns is released, veth_dellink() queues peer netns device
> for removal
> 2. peer netns is queued for removal
> 3. peer netns device is released, unreg event is triggered
> 4. unreg event is ignored because netns is going down
> 5. pre_exit hook calls nft_netdev_unregister_hooks but device memory
> might be free'd already.
Applied to nf, thanks
prev parent reply other threads:[~2023-05-10 6:32 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-05-04 12:20 [PATCH nf] netfilter: nf_tables: always release netdev hooks from notifier Florian Westphal
2023-05-10 6:32 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZFs6drN7cVJ2UQYy@calendula \
--to=pablo@netfilter.org \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox