[net,1/5] netfilter: ipset: Fix suspicious rcu_dereference_protected()

Commit Message

Pablo Neira Ayuso June 19, 2024, 5:05 p.m. UTC

From: Jozsef Kadlecsik <[e-mail]>

When destroying all sets, we are either in pernet exit phase or
are executing a "destroy all sets command" from userspace. The latter
was taken into account in ip_set_dereference() (nfnetlink mutex is held),
but the former was not. The patch adds the required check to
rcu_dereference_protected() in ip_set_dereference().

Fixes: 4e7aaa6b82d6 ("netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type")
Reported-by: [e-mail]
Reported-by: [e-mail]
Reported-by: kernel test robot <[e-mail]>
Closes: https://lore.kernel.org/oe-lkp/[e-mail]
Signed-off-by: Jozsef Kadlecsik <[e-mail]>
Signed-off-by: Pablo Neira Ayuso <[e-mail]>
---
 net/netfilter/ipset/ip_set_core.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

Comments

[e-mail] June 20, 2024, 9:50 a.m. UTC | #1

Hello:

This series was applied to netdev/net.git (main)
by Pablo Neira Ayuso <[e-mail]>:

On Wed, 19 Jun 2024 19:05:33 +0200 you wrote:
> From: Jozsef Kadlecsik <[e-mail]>
> 
> When destroying all sets, we are either in pernet exit phase or
> are executing a "destroy all sets command" from userspace. The latter
> was taken into account in ip_set_dereference() (nfnetlink mutex is held),
> but the former was not. The patch adds the required check to
> rcu_dereference_protected() in ip_set_dereference().
> 
> [...]

Here is the summary with links:
  - [net,1/5] netfilter: ipset: Fix suspicious rcu_dereference_protected()
    https://git.kernel.org/netdev/net/c/8ecd06277a76
  - [net,2/5] seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors
    https://git.kernel.org/netdev/net/c/9a3bc8d16e0a
  - [net,3/5] netfilter: move the sysctl nf_hooks_lwtunnel into the netfilter core
    https://git.kernel.org/netdev/net/c/a2225e0250c5
  - [net,4/5] selftests: add selftest for the SRv6 End.DX4 behavior with netfilter
    https://git.kernel.org/netdev/net/c/72e50ef99431
  - [net,5/5] selftests: add selftest for the SRv6 End.DX6 behavior with netfilter
    https://git.kernel.org/netdev/net/c/221200ffeb06

You are awesome, thank you!

Patch

diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index c7ae4d9bf3d2..61431690cbd5 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -53,12 +53,13 @@  MODULE_DESCRIPTION("core IP set support");
 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET);
 
 /* When the nfnl mutex or ip_set_ref_lock is held: */
-#define ip_set_dereference(p)		\
-	rcu_dereference_protected(p,	\
+#define ip_set_dereference(inst)	\
+	rcu_dereference_protected((inst)->ip_set_list,	\
 		lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET) || \
-		lockdep_is_held(&ip_set_ref_lock))
+		lockdep_is_held(&ip_set_ref_lock) || \
+		(inst)->is_deleted)
 #define ip_set(inst, id)		\
-	ip_set_dereference((inst)->ip_set_list)[id]
+	ip_set_dereference(inst)[id]
 #define ip_set_ref_netlink(inst,id)	\
 	rcu_dereference_raw((inst)->ip_set_list)[id]
 #define ip_set_dereference_nfnl(p)	\
@@ -1133,7 +1134,7 @@  static int ip_set_create(struct sk_buff *skb, const struct nfnl_info *info,
 		if (!list)
 			goto cleanup;
 		/* nfnl mutex is held, both lists are valid */
-		tmp = ip_set_dereference(inst->ip_set_list);
+		tmp = ip_set_dereference(inst);
 		memcpy(list, tmp, sizeof(struct ip_set *) * inst->ip_set_max);
 		rcu_assign_pointer(inst->ip_set_list, list);
 		/* Make sure all current packets have passed through */