Re: [PATCH net 4/9] netfilter: cttimeout: prevent UAF during module unload

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Sep 08, 2026 at 06:04:01PM +0000, netdev-bot+sashiko@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential
> issue(s) to consider:
> 
> Critical: 0 · High: 1 · Medium: 0 · Low: 0
> 
> - [High] cttimeout_exit() only drains RCU readers that reach the per-net
>   timeout storage through nf_ct_timeout_hook.
> 
> --
> 
> netfilter: cttimeout: prevent UAF during module unload
> 
> This reorders cttimeout_exit() so that nf_ct_timeout_hook is cleared and
> synchronize_net() is called before unregister_pernet_subsys() frees the
> per-net timeout storage.  That closes the window where nf_ct_set_timeout()
> could still reach the freed nfct_timeout_pernet blob through the hook.
> 
> > diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
> > index 66c2016f6049d..132c02ac7c4ea 100644
> > --- a/net/netfilter/nfnetlink_cttimeout.c
> > +++ b/net/netfilter/nfnetlink_cttimeout.c
> > @@ -652,9 +652,9 @@ static void __exit cttimeout_exit(void)
> >  {
> >  	nfnetlink_subsys_unregister(&cttimeout_subsys);
> >  
> > -	unregister_pernet_subsys(&cttimeout_ops);
> >  	RCU_INIT_POINTER(nf_ct_timeout_hook, NULL);
> >  	synchronize_net();
> > +	unregister_pernet_subsys(&cttimeout_ops);
> >  }
> 
> [Severity: High]
> Does this leave the same per-net object reachable from the netlink dump
> path during unload?
> 
> cttimeout_get_timeout() starts the dump without a module reference:
> 
> net/netfilter/nfnetlink_cttimeout.c:cttimeout_get_timeout() {
> 	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
> 		struct netlink_dump_control c = {
> 			.dump = ctnl_timeout_dump,
> 		};
> 		return netlink_dump_start(info->sk, skb, info->nlh, &c);
> 	}
> 
> With no .module set, __netlink_dump_start()'s try_module_get(control->module)
> is try_module_get(NULL), which succeeds without taking anything, and
> cb->module stays NULL.  nf_tables_api.c and nfnetlink_hook.c pass
> .module = THIS_MODULE in their netlink_dump_control for comparison.

This is a pre-existing issue. I can follow up on this.