netfilter: flowtable_offload: add missing locking

[ Upstream commit bcd9e3c1656d0f7dd9743598c65c3ae24efb38d0 ]

nf_flow_table_block_setup and the driver TC_SETUP_FT call can modify the flow
block cb list while they are being traversed elsewhere, causing a crash.
Add a write lock around the calls to protect readers

Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
Reported-by: Chad Monroe <chad.monroe@smartrg.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index d1862782be450307f5a392e7d22d688393031a0d..28306cb667190b9e9a833e9ca5bffd9912600f7b 100644 (file)
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -910,6 +910,7 @@ static int nf_flow_table_block_setup(struct nf_flowtable *flowtable,
        struct flow_block_cb *block_cb, *next;
        int err = 0;
 
+       down_write(&flowtable->flow_block_lock);
        switch (cmd) {
        case FLOW_BLOCK_BIND:
                list_splice(&bo->cb_list, &flowtable->flow_block.cb_list);
@@ -924,6 +925,7 @@ static int nf_flow_table_block_setup(struct nf_flowtable *flowtable,
                WARN_ON_ONCE(1);
                err = -EOPNOTSUPP;
        }
+       up_write(&flowtable->flow_block_lock);
 
        return err;
 }
@@ -980,7 +982,9 @@ static int nf_flow_table_offload_cmd(struct flow_block_offload *bo,
 
        nf_flow_table_block_offload_init(bo, dev_net(dev), cmd, flowtable,
                                         extack);
+       down_write(&flowtable->flow_block_lock);
        err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_FT, bo);
+       up_write(&flowtable->flow_block_lock);
        if (err < 0)
                return err;