Attachment 875370 Details for Bug 1215420

[patch] 0001-netfilter-implement-reference-counting-for-nft_sets.patch

0001-netfilter-Implement-reference-counting-for-nft_sets.patch (text/plain), 2.50 KB, created by Hannes Reinecke on 2024-06-07 14:32:05 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Hannes Reinecke

Created: 2024-06-07 14:32:05 UTC

Size: 2.50 KB

patch

obsolete

>From ffa5fd3d0f92aac4190fb3998653d2b52717e90d Mon Sep 17 00:00:00 2001
>From: Hannes Reinecke <hare@kernel.org>
>Date: Fri, 7 Jun 2024 15:53:24 +0200
>Subject: [PATCH 1/2] netfilter: Implement reference counting for nft_sets
>
>nft_sets are cleaned up during garbage collection, so implement
>reference counting to avoid use-after-free.
>
>Signed-off-by: Hannes Reinecke <hare@suse.de>
>---
> include/net/netfilter/nf_tables.h |  2 ++
> net/netfilter/nf_tables_api.c     | 21 ++++++++++++++++++++-
> 2 files changed, 22 insertions(+), 1 deletion(-)
>
>diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
>index 4bd7508bedc9f..0d97cafa365ce 100644
>--- a/include/net/netfilter/nf_tables.h
>+++ b/include/net/netfilter/nf_tables.h
>@@ -312,6 +312,8 @@ struct nft_set {
> 	u64				timeout;
> 	u32				gc_int;
> 	u16				policy;
>+	/* alignment hole of 40 bytes due to alignemt */
>+	struct kref			refs;
> 	/* runtime data below here */
> 	const struct nft_set_ops	*ops ____cacheline_aligned;
> 	possible_net_t			pnet;
>diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
>index 052bb02b73748..29836b8575f8a 100644
>--- a/net/netfilter/nf_tables_api.c
>+++ b/net/netfilter/nf_tables_api.c
>@@ -325,6 +325,22 @@ static int nft_delrule_by_chain(struct nft_ctx *ctx)
> /* Internal set flag */
> #define NFT_SET_INACTIVE	(1 << 15)
> 
>+static void __nft_set_put(struct kref *kref)
>+{
>+	struct nft_set *set = container_of(kref, struct nft_set, refs);
>+	kfree(set);
>+}
>+
>+int nft_set_get(struct nft_set *set)
>+{
>+	return kref_get_unless_zero(&set->refs);
>+}
>+
>+void nft_set_put(struct nft_set *set)
>+{
>+	kref_put(&set->refs, __nft_set_put);
>+}
>+
> static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type,
> 			     struct nft_set *set)
> {
>@@ -339,6 +355,8 @@ static int nft_trans_set_add(struct nft_ctx *ctx, int msg_type,
> 			ntohl(nla_get_be32(ctx->nla[NFTA_SET_ID]));
> 		set->flags |= NFT_SET_INACTIVE;
> 	}
>+	if (!nft_set_get(set))
>+		return -EAGAIN;
> 	nft_trans_set(trans) = set;
> 	list_add_tail(&trans->list, &ctx->net->nft.commit_list);
> 
>@@ -2843,6 +2861,7 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
> 	set->policy = policy;
> 	set->timeout = timeout;
> 	set->gc_int = gc_int;
>+	kref_init(&set->refs);
> 
> 	err = ops->init(set, &desc, nla);
> 	if (err < 0)
>@@ -2867,7 +2886,7 @@ static void nft_set_destroy(struct nft_set *set)
> {
> 	set->ops->destroy(set);
> 	module_put(set->ops->owner);
>-	kfree(set);
>+	nft_set_put(set);
> }
> 
> static void nf_tables_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
>-- 
>2.35.3
>

Actions: View | Diff

Attachments on bug 1215420: 875370 | 875371 | 875824