queue-6.6/netfilter-nf_tables-release-mutex-after-nft_gc_seq_end-from-abort-path.patch

   1 From 0d459e2ffb541841714839e8228b845458ed3b27 Mon Sep 17 00:00:00 2001
   2 From: Pablo Neira Ayuso <pablo@netfilter.org>
   3 Date: Thu, 28 Mar 2024 14:23:55 +0100
   4 Subject: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
   5
   6 From: Pablo Neira Ayuso <pablo@netfilter.org>
   7
   8 commit 0d459e2ffb541841714839e8228b845458ed3b27 upstream.
   9
  10 The commit mutex should not be released during the critical section
  11 between nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC
  12 worker could collect expired objects and get the released commit lock
  13 within the same GC sequence.
  14
  15 nf_tables_module_autoload() temporarily releases the mutex to load
  16 module dependencies, then it goes back to replay the transaction again.
  17 Move it at the end of the abort phase after nft_gc_seq_end() is called.
  18
  19 Cc: stable@vger.kernel.org
  20 Fixes: 720344340fb9 ("netfilter: nf_tables: GC transaction race with abort path")
  21 Reported-by: Kuan-Ting Chen <hexrabbit@devco.re>
  22 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  23 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  24 ---
  25  net/netfilter/nf_tables_api.c |   13 ++++++++-----
  26  1 file changed, 8 insertions(+), 5 deletions(-)
  27
  28 --- a/net/netfilter/nf_tables_api.c
  29 +++ b/net/netfilter/nf_tables_api.c
  30 @@ -10518,11 +10518,6 @@ static int __nf_tables_abort(struct net
  31                 nf_tables_abort_release(trans);
  32         }
  33
  34 -       if (action == NFNL_ABORT_AUTOLOAD)
  35 -               nf_tables_module_autoload(net);
  36 -       else
  37 -               nf_tables_module_autoload_cleanup(net);
  38 -
  39         return err;
  40  }
  41
  42 @@ -10539,6 +10534,14 @@ static int nf_tables_abort(struct net *n
  43
  44         WARN_ON_ONCE(!list_empty(&nft_net->commit_list));
  45
  46 +       /* module autoload needs to happen after GC sequence update because it
  47 +        * temporarily releases and grabs mutex again.
  48 +        */
  49 +       if (action == NFNL_ABORT_AUTOLOAD)
  50 +               nf_tables_module_autoload(net);
  51 +       else
  52 +               nf_tables_module_autoload_cleanup(net);
  53 +
  54         mutex_unlock(&nft_net->commit_mutex);
  55
  56         return ret;