Skip to content

Commit d78d867

Browse files
Ziyang Xuanummakynes
Ziyang Xuan
authored andcommitted
netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
nft_unregister_obj() can concurrent with __nft_obj_type_get(), and there is not any protection when iterate over nf_tables_objects list in __nft_obj_type_get(). Therefore, there is potential data-race of nf_tables_objects list entry. Use list_for_each_entry_rcu() to iterate over nf_tables_objects list in __nft_obj_type_get(), and use rcu_read_lock() in the caller nft_obj_type_get() to protect the entire type query process. Fixes: e500924 ("netfilter: nf_tables: add stateful objects") Signed-off-by: Ziyang Xuan <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
1 parent f969eb8 commit d78d867

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

net/netfilter/nf_tables_api.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7611,7 +7611,7 @@ static const struct nft_object_type *__nft_obj_type_get(u32 objtype, u8 family)
76117611
{
76127612
const struct nft_object_type *type;
76137613

7614-
list_for_each_entry(type, &nf_tables_objects, list) {
7614+
list_for_each_entry_rcu(type, &nf_tables_objects, list) {
76157615
if (type->family != NFPROTO_UNSPEC &&
76167616
type->family != family)
76177617
continue;
@@ -7627,9 +7627,13 @@ nft_obj_type_get(struct net *net, u32 objtype, u8 family)
76277627
{
76287628
const struct nft_object_type *type;
76297629

7630+
rcu_read_lock();
76307631
type = __nft_obj_type_get(objtype, family);
7631-
if (type != NULL && try_module_get(type->owner))
7632+
if (type != NULL && try_module_get(type->owner)) {
7633+
rcu_read_unlock();
76327634
return type;
7635+
}
7636+
rcu_read_unlock();
76337637

76347638
lockdep_nfnl_nft_mutex_not_held();
76357639
#ifdef CONFIG_MODULES

0 commit comments

Comments
 (0)