Re: [PATCH v2 1/2] netfilter: ip_tables: guard ipt_unregister_table_pre_exit against NULL ops

Tristan Madani
2026-04-30T21:49:57Z

Florian Westphal <fw@strlen.de> wrote:
> Is there a reproducer for this bug?

Syzkaller hit it under failslab. The race is between the lazy
init path in ipt_register_table() and cleanup_net(). The table
becomes visible via xt_register_table() before ops is assigned,
so pre_exit can find it with NULL ops.

Cleaned crash log:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 1 UID: 0 PID: 604 Comm: kworker/u8:19 Tainted: G E 6.14.11 #1
Workqueue: netns cleanup_net
RIP: 0010:nf_unregister_net_hook net/netfilter/core.c:531 [inline]
RIP: 0010:nf_unregister_net_hooks+0xbc/0x150 net/netfilter/core.c:613
Call Trace:
<TASK>
ipt_unregister_table_pre_exit+0x8a/0xc0 net/ipv4/netfilter/ip_tables.c:1814
iptable_mangle_net_pre_exit+0x21/0x30 net/ipv4/netfilter/iptable_mangle.c:99
ops_pre_exit_list net/core/net_namespace.c:162 [inline]
cleanup_net+0x4b9/0xbe0 net/core/net_namespace.c:632
process_one_work+0x98f/0x1750 kernel/workqueue.c:3238
worker_thread+0x679/0xf50 kernel/workqueue.c:3402
kthread+0x3f0/0x7e0 kernel/kthread.c:464
ret_from_fork+0x60/0x90 arch/x86/kernel/process.c:153
</TASK>

> I'm working on a new unreg scheme to avoid rmmod racing with
> concurrent calls into iptables set/getsockopts.

That sounds like a different issue (rmmod vs sockopt). This one
is init vs cleanup_net -- the NULL ops window exists regardless
of the unreg scheme. V2 is a minimal guard for that.

Thanks,
Tristan