Hi,
The following patchset contains Netfilter fixes for net:
Patch #1 unlike early commit path stage which triggers a call to abort,
an explicit release of the batch is required on abort, otherwise
mutex is released and commit_list remains in place.
Patch #2 release mutex after nft_gc_seq_end() in commit path, otherwise
async GC worker could collect expired objects.
Patch #3 flush pending destroy work in module removal path, otherwise UaF
is possible.
Patch #4 and #6 restrict the table dormant flag with basechain updates
to fix state inconsistency in the hook registration.
Patch #5 adds missing RCU read side lock to flowtable type to avoid races
with module removal.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-04-04
Thanks.
----------------------------------------------------------------
The following changes since commit 72076fc9fe60b9143cd971fd8737718719bc512e:
Revert "tg3: Remove residual error handling in tg3_suspend" (2024-04-04 10:51:01 +0200)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-04-04
for you to fetch changes up to 1bc83a019bbe268be3526406245ec28c2458a518:
netfilter: nf_tables: discard table flag update with pending basechain deletion (2024-04-04 11:38:35 +0200)
----------------------------------------------------------------
netfilter pull request 24-04-04
----------------------------------------------------------------
Pablo Neira Ayuso (5):
netfilter: nf_tables: release batch on table validation from abort path
netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
netfilter: nf_tables: flush pending destroy work before exit_net release
netfilter: nf_tables: reject new basechain after table flag update
netfilter: nf_tables: discard table flag update with pending basechain deletion
Ziyang Xuan (1):
netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()
net/netfilter/nf_tables_api.c | 50 +++++++++++++++++++++++++++++--------------
1 file changed, 34 insertions(+), 16 deletions(-)
Hi, The following patchset contains Netfilter fixes for net: Patch #1 unlike early commit path stage which triggers a call to abort, an explicit release of the batch is required on abort, otherwise mutex is released and commit_list remains in place. Patch #2 release mutex after nft_gc_seq_end() in commit path, otherwise async GC worker could collect expired objects. Patch #3 flush pending destroy work in module removal path, otherwise UaF is possible. Patch #4 and #6 restrict the table dormant flag with basechain updates to fix state inconsistency in the hook registration. Patch #5 adds missing RCU read side lock to flowtable type to avoid races with module removal. Please, pull these changes from: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-04-04 Thanks. ---------------------------------------------------------------- The following changes since commit 72076fc9fe60b9143cd971fd8737718719bc512e: Revert "tg3: Remove residual error handling in tg3_suspend" (2024-04-04 10:51:01 +0200) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-04-04 for you to fetch changes up to 1bc83a019bbe268be3526406245ec28c2458a518: netfilter: nf_tables: discard table flag update with pending basechain deletion (2024-04-04 11:38:35 +0200) ---------------------------------------------------------------- netfilter pull request 24-04-04 ---------------------------------------------------------------- Pablo Neira Ayuso (5): netfilter: nf_tables: release batch on table validation from abort path netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path netfilter: nf_tables: flush pending destroy work before exit_net release netfilter: nf_tables: reject new basechain after table flag update netfilter: nf_tables: discard table flag update with pending basechain deletion Ziyang Xuan (1): netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() net/netfilter/nf_tables_api.c | 50 +++++++++++++++++++++++++++++-------------- 1 file changed, 34 insertions(+), 16 deletions(-)