From: Pablo Neira Ayuso Date: Mon, 30 May 2022 16:24:05 +0000 (+0200) Subject: netfilter: nf_tables: hold mutex on netns pre_exit path X-Git-Tag: v5.18.2~57 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cc7c6e0a8e1d45955b976943dbd4ba98448ceb46;p=thirdparty%2Fkernel%2Fstable.git netfilter: nf_tables: hold mutex on netns pre_exit path commit 3923b1e4406680d57da7e873da77b1683035d83f upstream. clean_net() runs in workqueue while walking over the lists, grab mutex. Fixes: 767d1216bff8 ("netfilter: nftables: fix possible UAF over chains from packet path in netns") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman --- diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 40d58d1bb7233..d198d4683e1ad 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -9892,7 +9892,11 @@ static int __net_init nf_tables_init_net(struct net *net) static void __net_exit nf_tables_pre_exit_net(struct net *net) { + struct nftables_pernet *nft_net = nft_pernet(net); + + mutex_lock(&nft_net->commit_mutex); __nft_release_hooks(net); + mutex_unlock(&nft_net->commit_mutex); } static void __net_exit nf_tables_exit_net(struct net *net)