From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 96183C43217 for ; Tue, 8 Nov 2022 13:49:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234606AbiKHNtq (ORCPT ); Tue, 8 Nov 2022 08:49:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49558 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234608AbiKHNtp (ORCPT ); Tue, 8 Nov 2022 08:49:45 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A6AF8F3A for ; Tue, 8 Nov 2022 05:49:44 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 672DBB81AE2 for ; Tue, 8 Nov 2022 13:49:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 76490C433D6; Tue, 8 Nov 2022 13:49:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1667915382; bh=SW+E9SeCuDcSBKxnp/B6vOPmoqesUPY5GcJ/WFeD7xk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VPzXH5hrWgx6IXyEzku48XivmgHFoSR39T4AlbTlyydgMDCQAVcHM1ANTJgELFI20 I2aSNMTi52XqnuUCOtlBog6VWcwWDVwlfYiZzkOTB9aIz6D980aaZAZh7XIwjFRey4 +ILRg+iUzkcZAW1h4V1n5+bhwF6pGHZbtKRIsY1c= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+8f747f62763bc6c32916@syzkaller.appspotmail.com, Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 5.4 15/74] netfilter: nf_tables: release flow rule object from commit path Date: Tue, 8 Nov 2022 14:38:43 +0100 Message-Id: <20221108133334.316239931@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221108133333.659601604@linuxfoundation.org> References: <20221108133333.659601604@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Pablo Neira Ayuso [ Upstream commit 26b5934ff4194e13196bedcba373cd4915071d0e ] No need to postpone this to the commit release path, since no packets are walking over this object, this is accessed from control plane only. This helped uncovered UAF triggered by races with the netlink notifier. Fixes: 9dd732e0bdf5 ("netfilter: nf_tables: memleak flow rule from commit path") Reported-by: syzbot+8f747f62763bc6c32916@syzkaller.appspotmail.com Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/netfilter/nf_tables_api.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index f9cecd30f1ba..140c24f1b6c6 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -6576,9 +6576,6 @@ static void nft_commit_release(struct nft_trans *trans) nf_tables_chain_destroy(&trans->ctx); break; case NFT_MSG_DELRULE: - if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) - nft_flow_rule_destroy(nft_trans_flow_rule(trans)); - nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans)); break; case NFT_MSG_DELSET: @@ -6913,6 +6910,9 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) nft_rule_expr_deactivate(&trans->ctx, nft_trans_rule(trans), NFT_TRANS_COMMIT); + + if (trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) + nft_flow_rule_destroy(nft_trans_flow_rule(trans)); break; case NFT_MSG_NEWSET: nft_clear(net, nft_trans_set(trans)); -- 2.35.1