• Pablo Neira Ayuso's avatar
    netfilter: nf_tables: double hook unregistration in netns path · f9a43007
    Pablo Neira Ayuso authored
    __nft_release_hooks() is called from pre_netns exit path which
    unregisters the hooks, then the NETDEV_UNREGISTER event is triggered
    which unregisters the hooks again.
    
    [  565.221461] WARNING: CPU: 18 PID: 193 at net/netfilter/core.c:495 __nf_unregister_net_hook+0x247/0x270
    [...]
    [  565.246890] CPU: 18 PID: 193 Comm: kworker/u64:1 Tainted: G            E     5.18.0-rc7+ #27
    [  565.253682] Workqueue: netns cleanup_net
    [  565.257059] RIP: 0010:__nf_unregister_net_hook+0x247/0x270
    [...]
    [  565.297120] Call Trace:
    [  565.300900]  <TASK>
    [  565.304683]  nf_tables_flowtable_event+0x16a/0x220 [nf_tables]
    [  565.308518]  raw_notifier_call_chain+0x63/0x80
    [  565.312386]  unregister_netdevice_many+0x54f/0xb50
    
    Unregister and destroy netdev hook from netns pre_exit via kfree_rcu
    so the NETDEV_UNREGISTER path see unregistered hooks.
    
    Fixes: 767d1216 ("netfilter: nftables: fix possible UAF over chains from packet path in netns")
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    f9a43007
nf_tables_api.c 243 KB