releases/5.10.215/netfilter-nf_tables-mark-set-as-dead-when-unbinding-anonymous-set-with-timeout.patch

   1 From 552705a3650bbf46a22b1adedc1b04181490fc36 Mon Sep 17 00:00:00 2001
   2 From: Pablo Neira Ayuso <pablo@netfilter.org>
   3 Date: Mon, 4 Mar 2024 14:22:12 +0100
   4 Subject: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
   5
   6 From: Pablo Neira Ayuso <pablo@netfilter.org>
   7
   8 commit 552705a3650bbf46a22b1adedc1b04181490fc36 upstream.
   9
  10 While the rhashtable set gc runs asynchronously, a race allows it to
  11 collect elements from anonymous sets with timeouts while it is being
  12 released from the commit path.
  13
  14 Mingi Cho originally reported this issue in a different path in 6.1.x
  15 with a pipapo set with low timeouts which is not possible upstream since
  16 7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set
  17 element timeout").
  18
  19 Fix this by setting on the dead flag for anonymous sets to skip async gc
  20 in this case.
  21
  22 According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on
  23 transaction abort"), Florian plans to accelerate abort path by releasing
  24 objects via workqueue, therefore, this sets on the dead flag for abort
  25 path too.
  26
  27 Cc: stable@vger.kernel.org
  28 Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane")
  29 Reported-by: Mingi Cho <mgcho.minic@gmail.com>
  30 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  31 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  32 ---
  33  net/netfilter/nf_tables_api.c |    1 +
  34  1 file changed, 1 insertion(+)
  35
  36 --- a/net/netfilter/nf_tables_api.c
  37 +++ b/net/netfilter/nf_tables_api.c
  38 @@ -4754,6 +4754,7 @@ static void nf_tables_unbind_set(const s
  39
  40         if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) {
  41                 list_del_rcu(&set->list);
  42 +               set->dead = 1;
  43                 if (event)
  44                         nf_tables_set_notify(ctx, set, NFT_MSG_DELSET,
  45                                              GFP_KERNEL);