diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-02-02 18:07:37 +0300 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-02-04 02:33:09 +0300 |
| commit | 767d1216bff82507c945e92fe719dff2083bb2f4 (patch) | |
| tree | 89aa5dc4df79d38b67a479ace62e396d3b78dd11 /net/netfilter/nf_flow_table_core.c | |
| parent | a3005b0f83f217c888393c6bf9cd36e3d1616bca (diff) | |
| download | linux-767d1216bff82507c945e92fe719dff2083bb2f4.tar.xz | |
netfilter: nftables: fix possible UAF over chains from packet path in netns
Although hooks are released via call_rcu(), chain and rule objects are
immediately released while packets are still walking over these bits.
This patch adds the .pre_exit callback which is invoked before
synchronize_rcu() in the netns framework to stay safe.
Remove a comment which is not valid anymore since the core does not use
synchronize_net() anymore since 8c873e219970 ("netfilter: core: free
hooks with call_rcu").
Suggested-by: Florian Westphal <fw@strlen.de>
Fixes: df05ef874b28 ("netfilter: nf_tables: release objects on netns destruction")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nf_flow_table_core.c')
0 files changed, 0 insertions, 0 deletions