Re: Patch "netfilter: ipset: Fix suspicious rcu_dereference_protected()" has been added to the 6.9-stable tree

Re: Patch "netfilter: ipset: Fix suspicious rcu_dereference_protected()" has been added to the 6.9-stable tree

[Pablo Neira Ayuso]

Hi

Side note: This fix requires

        4e7aaa6b82d6 ("netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type"

in first place, as a dependency.

Thanks

On Sat, Jun 22, 2024 at 07:41:24PM -0400, Sasha Levin wrote:
> This is a note to let you know that I've just added the patch titled
> 
>     netfilter: ipset: Fix suspicious rcu_dereference_protected()
> 
> to the 6.9-stable tree which can be found at:
>     http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
> 
> The filename of the patch is:
>      netfilter-ipset-fix-suspicious-rcu_dereference_prote.patch
> and it can be found in the queue-6.9 subdirectory.
> 
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable@vger.kernel.org> know about it.
> 
> 
> 
> commit 0226dfa53edc90463c1b0d50167da948c88025ef
> Author: Jozsef Kadlecsik <kadlec@netfilter.org>
> Date:   Mon Jun 17 11:18:15 2024 +0200
> 
>     netfilter: ipset: Fix suspicious rcu_dereference_protected()
>     
>     [ Upstream commit 8ecd06277a7664f4ef018abae3abd3451d64e7a6 ]
>     
>     When destroying all sets, we are either in pernet exit phase or
>     are executing a "destroy all sets command" from userspace. The latter
>     was taken into account in ip_set_dereference() (nfnetlink mutex is held),
>     but the former was not. The patch adds the required check to
>     rcu_dereference_protected() in ip_set_dereference().
>     
>     Fixes: 4e7aaa6b82d6 ("netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type")
>     Reported-by: syzbot+b62c37cdd58103293a5a@syzkaller.appspotmail.com
>     Reported-by: syzbot+cfbe1da5fdfc39efc293@syzkaller.appspotmail.com
>     Reported-by: kernel test robot <oliver.sang@intel.com>
>     Closes: https://lore.kernel.org/oe-lkp/202406141556.e0b6f17e-lkp@intel.com
>     Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
>     Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
>     Signed-off-by: Sasha Levin <sashal@kernel.org>
> 
> diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
> index c7ae4d9bf3d24..61431690cbd5f 100644
> --- a/net/netfilter/ipset/ip_set_core.c
> +++ b/net/netfilter/ipset/ip_set_core.c
> @@ -53,12 +53,13 @@ MODULE_DESCRIPTION("core IP set support");
>  MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET);
>  
>  /* When the nfnl mutex or ip_set_ref_lock is held: */
> -#define ip_set_dereference(p)		\
> -	rcu_dereference_protected(p,	\
> +#define ip_set_dereference(inst)	\
> +	rcu_dereference_protected((inst)->ip_set_list,	\
>  		lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET) || \
> -		lockdep_is_held(&ip_set_ref_lock))
> +		lockdep_is_held(&ip_set_ref_lock) || \
> +		(inst)->is_deleted)
>  #define ip_set(inst, id)		\
> -	ip_set_dereference((inst)->ip_set_list)[id]
> +	ip_set_dereference(inst)[id]
>  #define ip_set_ref_netlink(inst,id)	\
>  	rcu_dereference_raw((inst)->ip_set_list)[id]
>  #define ip_set_dereference_nfnl(p)	\
> @@ -1133,7 +1134,7 @@ static int ip_set_create(struct sk_buff *skb, const struct nfnl_info *info,
>  		if (!list)
>  			goto cleanup;
>  		/* nfnl mutex is held, both lists are valid */
> -		tmp = ip_set_dereference(inst->ip_set_list);
> +		tmp = ip_set_dereference(inst);
>  		memcpy(list, tmp, sizeof(struct ip_set *) * inst->ip_set_max);
>  		rcu_assign_pointer(inst->ip_set_list, list);
>  		/* Make sure all current packets have passed through */