diff options
| author | Pavel Skripkin <paskripkin@gmail.com> | 2021-08-10 15:59:20 +0300 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-08-11 12:22:19 +0300 |
| commit | e3245a7b7b34bd2e97f744fd79463add6e9d41f4 (patch) | |
| tree | 2ac2841ab3b72613e88ce2046d4d6ef9463bd7ef /Documentation/networking/nf_conntrack-sysctl.rst | |
| parent | 519133debcc19f5c834e7e28480b60bdc234fe02 (diff) | |
| download | linux-e3245a7b7b34bd2e97f744fd79463add6e9d41f4.tar.xz | |
netfilter: nft_ct: protect nft_ct_pcpu_template_refcnt with mutex
Syzbot hit use-after-free in nf_tables_dump_sets. The problem was in
missing lock protection for nft_ct_pcpu_template_refcnt.
Before commit f102d66b335a ("netfilter: nf_tables: use dedicated
mutex to guard transactions") all transactions were serialized by global
mutex, but then global mutex was changed to local per netnamespace
commit_mutex.
This change causes use-after-free bug, when 2 netnamespaces concurently
changing nft_ct_pcpu_template_refcnt without proper locking. Fix it by
adding nft_ct_pcpu_mutex and protect all nft_ct_pcpu_template_refcnt
changes with it.
Fixes: f102d66b335a ("netfilter: nf_tables: use dedicated mutex to guard transactions")
Reported-and-tested-by: syzbot+649e339fa6658ee623d3@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'Documentation/networking/nf_conntrack-sysctl.rst')
0 files changed, 0 insertions, 0 deletions