netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()

[ Upstream commit f969eb8 ] nft_unregister_expr() can concurrent with __nft_expr_type_get(), and there is not any protection when iterate over nf_tables_expressions list in __nft_expr_type_get(). Therefore, there is potential data-race of nf_tables_expressions list entry. Use list_for_each_entry_rcu() to iterate over nf_tables_expressions list in __nft_expr_type_get(), and use rcu_read_lock() in the caller nft_expr_type_get() to protect the entire type query process. Fixes: ef1f7df ("netfilter: nf_tables: expression ops overloading") Signed-off-by: Ziyang Xuan <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
hardkernel · May 2, 2024 · b38a133 · b38a133
1 parent 2450a69
commit b38a133
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
@@ -2239,7 +2239,7 @@ static const struct nft_expr_type *__nft_expr_type_get(u8 family,
 {
  const struct nft_expr_type *type, *candidate = NULL;
 
- list_for_each_entry(type, &nf_tables_expressions, list) {
+ list_for_each_entry_rcu(type, &nf_tables_expressions, list) {
  if (!nla_strcmp(nla, type->name)) {
  if (!type->family && !candidate)
  candidate = type;
@@ -2271,9 +2271,13 @@ static const struct nft_expr_type *nft_expr_type_get(struct net *net,
  if (nla == NULL)
  return ERR_PTR(-EINVAL);
 
+ rcu_read_lock();
  type = __nft_expr_type_get(family, nla);
- if (type != NULL && try_module_get(type->owner))
+ if (type != NULL && try_module_get(type->owner)) {
+ rcu_read_unlock();
  return type;
+ }
+ rcu_read_unlock();
 
  lockdep_nfnl_nft_mutex_not_held();
 #ifdef CONFIG_MODULES