Thadeu Lima de Souza Cascardo fc95c8b02c netfilter: nf_tables: do not ignore genmask when looking up chain by id ... commit 515ad53079 upstream. When adding a rule to a chain referring to its ID, if that chain had been deleted on the same batch, the rule might end up referring to a deleted chain. This will lead to a WARNING like following: [ 33.098431] ------------[ cut here ]------------ [ 33.098678] WARNING: CPU: 5 PID: 69 at net/netfilter/nf_tables_api.c:2037 nf_tables_chain_destroy+0x23d/0x260 [ 33.099217] Modules linked in: [ 33.099388] CPU: 5 PID: 69 Comm: kworker/5:1 Not tainted 6.4.0+ #409 [ 33.099726] Workqueue: events nf_tables_trans_destroy_work [ 33.100018] RIP: 0010:nf_tables_chain_destroy+0x23d/0x260 [ 33.100306] Code: 8b 7c 24 68 e8 64 9c ed fe 4c 89 e7 e8 5c 9c ed fe 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 89 c6 89 c7 c3 cc cc cc cc <0f> 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 89 c6 89 c7 [ 33.101271] RSP: 0018:ffffc900004ffc48 EFLAGS: 00010202 [ 33.101546] RAX: 0000000000000001 RBX: ffff888006fc0a28 RCX: 0000000000000000 [ 33.101920] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 33.102649] RBP: ffffc900004ffc78 R08: 0000000000000000 R09: 0000000000000000 [ 33.103018] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880135ef500 [ 33.103385] R13: 0000000000000000 R14: dead000000000122 R15: ffff888006fc0a10 [ 33.103762] FS: 0000000000000000(0000) GS:ffff888024c80000(0000) knlGS:0000000000000000 [ 33.104184] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.104493] CR2: 00007fe863b56a50 CR3: 00000000124b0001 CR4: 0000000000770ee0 [ 33.104872] PKRU: 55555554 [ 33.104999] Call Trace: [ 33.105113] <TASK> [ 33.105214] ? show_regs+0x72/0x90 [ 33.105371] ? __warn+0xa5/0x210 [ 33.105520] ? nf_tables_chain_destroy+0x23d/0x260 [ 33.105732] ? report_bug+0x1f2/0x200 [ 33.105902] ? handle_bug+0x46/0x90 [ 33.106546] ? exc_invalid_op+0x19/0x50 [ 33.106762] ? asm_exc_invalid_op+0x1b/0x20 [ 33.106995] ? nf_tables_chain_destroy+0x23d/0x260 [ 33.107249] ? nf_tables_chain_destroy+0x30/0x260 [ 33.107506] nf_tables_trans_destroy_work+0x669/0x680 [ 33.107782] ? mark_held_locks+0x28/0xa0 [ 33.107996] ? __pfx_nf_tables_trans_destroy_work+0x10/0x10 [ 33.108294] ? _raw_spin_unlock_irq+0x28/0x70 [ 33.108538] process_one_work+0x68c/0xb70 [ 33.108755] ? lock_acquire+0x17f/0x420 [ 33.108977] ? __pfx_process_one_work+0x10/0x10 [ 33.109218] ? do_raw_spin_lock+0x128/0x1d0 [ 33.109435] ? _raw_spin_lock_irq+0x71/0x80 [ 33.109634] worker_thread+0x2bd/0x700 [ 33.109817] ? __pfx_worker_thread+0x10/0x10 [ 33.110254] kthread+0x18b/0x1d0 [ 33.110410] ? __pfx_kthread+0x10/0x10 [ 33.110581] ret_from_fork+0x29/0x50 [ 33.110757] </TASK> [ 33.110866] irq event stamp: 1651 [ 33.111017] hardirqs last enabled at (1659): [<ffffffffa206a209>] __up_console_sem+0x79/0xa0 [ 33.111379] hardirqs last disabled at (1666): [<ffffffffa206a1ee>] __up_console_sem+0x5e/0xa0 [ 33.111740] softirqs last enabled at (1616): [<ffffffffa1f5d40e>] __irq_exit_rcu+0x9e/0xe0 [ 33.112094] softirqs last disabled at (1367): [<ffffffffa1f5d40e>] __irq_exit_rcu+0x9e/0xe0 [ 33.112453] ---[ end trace 0000000000000000 ]--- This is due to the nft_chain_lookup_byid ignoring the genmask. After this change, adding the new rule will fail as it will not find the chain. Fixes: 837830a4b4 ("netfilter: nf_tables: add NFTA_RULE_CHAIN_ID attribute") Cc: stable@vger.kernel.org Reported-by: Mingi Cho of Theori working with ZDI Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Reviewed-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-07-19 16:22:17 +02:00
..
6lowpan
9p	9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition	2023-04-20 12:35:08 +02:00
802	mrp: introduce active flags to prevent UAF when applicant uninit	2022-12-31 13:33:02 +01:00
8021q	vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()	2023-05-24 17:32:47 +01:00
appletalk
atm	atm: hide unused procfs functions	2023-06-09 10:34:16 +02:00
ax25
batman-adv	batman-adv: Broken sync while rescheduling delayed work	2023-06-14 11:15:23 +02:00
bluetooth	Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable	2023-07-19 16:22:02 +02:00
bpf	Revert "bpf, test_run: fix &xdp_frame misplacement for LIVE_FRAMES"	2023-03-17 08:50:32 +01:00
bpfilter
bridge	net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode	2023-07-19 16:22:04 +02:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-17 08:50:24 +01:00
can	can: isotp: isotp_sendmsg(): fix return error fix on TX path	2023-07-01 13:16:23 +02:00
ceph	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
core	netlink: Add __sock_i_ino() for __netlink_diag_dump().	2023-07-19 16:21:13 +02:00
dcb
dccp	netfilter: keep conntrack reference until IPsecv6 policy checks are done	2023-05-11 23:03:18 +09:00
dns_resolver
dsa	net: dsa: sja1105: always enable the send_meta options	2023-07-19 16:22:06 +02:00
ethernet	net: gro: skb_gro_header helper function	2022-08-25 10:33:21 +02:00
ethtool	ethtool: Fix uninitialized number of lanes	2023-05-17 11:53:37 +02:00
hsr	hsr: ratelimit only when errors are printed	2023-04-06 12:10:58 +02:00
ieee802154	net: ieee802154: fix error return code in dgram_bind()	2022-10-07 09:29:17 +02:00
ife
ipv4	tcp: annotate data races in __tcp_oow_rate_limited()	2023-07-19 16:22:05 +02:00
ipv6	xfrm: Linearize the skb after offloading if needed.	2023-06-28 11:12:29 +02:00
iucv	net/iucv: Fix size of interrupt data	2023-03-22 13:33:50 +01:00
kcm	kcm: close race conditions on sk_receive_queue	2022-11-15 12:42:26 +01:00
key	af_key: Reject optional tunnel/BEET mode templates in outbound policies	2023-05-24 17:32:43 +01:00
l2tp	inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().	2023-04-26 14:28:43 +02:00
l3mdev
lapb
llc	net: deal with most data-races in sk_wait_event()	2023-05-24 17:32:32 +01:00
mac80211	wifi: mac80211: Remove "Missing iftype sband data/EHT cap" spam	2023-07-19 16:21:09 +02:00
mac802154	mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()	2022-12-05 09:53:08 +01:00
mctp	net: mctp: purge receive queues on sk destruction	2023-02-06 08:06:34 +01:00
mpls	net: mpls: fix stale pointer if allocation fails during device rename	2023-02-22 12:59:53 +01:00
mptcp	mptcp: ensure listener is unhashed before updating the sk status	2023-07-01 13:16:22 +02:00
ncsi	net/ncsi: clear Tx enable mode when handling a Config required AEN	2023-05-17 11:53:32 +02:00
netfilter	netfilter: nf_tables: do not ignore genmask when looking up chain by id	2023-07-19 16:22:17 +02:00
netlabel	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
netlink	netlink: Add __sock_i_ino() for __netlink_diag_dump().	2023-07-19 16:21:13 +02:00
netrom	netrom: fix info-leak in nr_write_internal()	2023-06-09 10:34:01 +02:00
nfc	net: nfc: Fix use-after-free caused by nfc_llcp_find_local	2023-07-19 16:21:13 +02:00
nsh	net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()	2023-05-24 17:32:45 +01:00
openvswitch	net: openvswitch: fix race on port output	2023-04-20 12:35:09 +02:00
packet	af_packet: do not use READ_ONCE() in packet_bind()	2023-06-09 10:34:02 +02:00
phonet
psample	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
qrtr	net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()	2023-04-20 12:35:09 +02:00
rds	rds: rds_rm_zerocopy_callback() correct order for list_add_tail()	2023-03-10 09:33:02 +01:00
rfkill
rose	net/rose: Fix to not accept on connected socket	2023-02-22 12:59:42 +01:00
rxrpc	rxrpc: Fix hard call timeout units	2023-05-17 11:53:35 +02:00
sched	net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX	2023-07-19 16:22:05 +02:00
sctp	sctp: fix potential deadlock on &net->sctp.addr_wq_lock	2023-07-19 16:22:00 +02:00
smc	net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT	2023-06-14 11:15:17 +02:00
strparser
sunrpc	SUNRPC: Fix UAF in svc_tcp_listen_data_ready()	2023-07-19 16:21:48 +02:00
switchdev
tipc	net: tipc: resize nlattr array to correct size	2023-06-21 16:01:02 +02:00
tls	tls: rx: strp: don't use GFP_KERNEL in softirq context	2023-06-09 10:34:29 +02:00
unix	bpf, sockmap: Pass skb ownership through read_skb	2023-06-05 09:26:18 +02:00
vmw_vsock	vsock: avoid to close connected socket after the timeout	2023-05-24 17:32:44 +01:00
wireless	wifi: cfg80211: fix regulatory disconnect for non-MLO	2023-07-19 16:22:09 +02:00
x25	net/x25: Fix to not accept on connected socket	2023-02-09 11:28:13 +01:00
xdp	xsk: Honor SO_BINDTODEVICE on bind	2023-07-19 16:22:05 +02:00
xfrm	xfrm: Ensure policies always checked on XFRM-I input path	2023-06-28 11:12:28 +02:00
compat.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
devres.c
Kconfig
Kconfig.debug	net: make NET_(DEV|NS)_REFCNT_TRACKER depend on NET	2022-09-20 14:23:56 -07:00
Makefile
socket.c	net: annotate sk->sk_err write from do_recvmmsg()	2023-05-24 17:32:32 +01:00
sysctl_net.c