netfilter: nftables: fix possible UAF over chains from packet path in netns

BugLink: https://bugs.launchpad.net/bugs/1918167
[ Upstream commit 767d1216bff82507c945e92fe719dff2083bb2f4 ]

Although hooks are released via call_rcu(), chain and rule objects are
immediately released while packets are still walking over these bits.

This patch adds the .pre_exit callback which is invoked before
synchronize_rcu() in the netns framework to stay safe.

Remove a comment which is not valid anymore since the core does not use
synchronize_net() anymore since 8c873e219970 ("netfilter: core: free
hooks with call_rcu").

Suggested-by: Florian Westphal <fw@strlen.de>
Fixes: df05ef874b28 ("netfilter: nf_tables: release objects on netns destruction")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Kelsey Skunberg <kelsey.skunberg@canonical.com>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 40216c2a7dd72755d6943da0f50578730b4d7382..373ea0e49f12dd3892cbecf81fb52365aaa03656 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -7696,6 +7696,17 @@ int __nft_release_basechain(struct nft_ctx *ctx)
 }
 EXPORT_SYMBOL_GPL(__nft_release_basechain);
 
+static void __nft_release_hooks(struct net *net)
+{
+       struct nft_table *table;
+       struct nft_chain *chain;
+
+       list_for_each_entry(table, &net->nft.tables, list) {
+               list_for_each_entry(chain, &table->chains, list)
+                       nf_tables_unregister_hook(net, table, chain);
+       }
+}
+
 static void __nft_release_tables(struct net *net)
 {
        struct nft_flowtable *flowtable, *nf;
@@ -7711,10 +7722,6 @@ static void __nft_release_tables(struct net *net)
 
        list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
                ctx.family = table->family;
-
-               list_for_each_entry(chain, &table->chains, list)
-                       nf_tables_unregister_hook(net, table, chain);
-               /* No packets are walking on these chains anymore. */
                ctx.table = table;
                list_for_each_entry(chain, &table->chains, list) {
                        ctx.chain = chain;
@@ -7762,6 +7769,11 @@ static int __net_init nf_tables_init_net(struct net *net)
        return 0;
 }
 
+static void __net_exit nf_tables_pre_exit_net(struct net *net)
+{
+       __nft_release_hooks(net);
+}
+
 static void __net_exit nf_tables_exit_net(struct net *net)
 {
        mutex_lock(&net->nft.commit_mutex);
@@ -7774,8 +7786,9 @@ static void __net_exit nf_tables_exit_net(struct net *net)
 }
 
 static struct pernet_operations nf_tables_net_ops = {
-       .init   = nf_tables_init_net,
-       .exit   = nf_tables_exit_net,
+       .init           = nf_tables_init_net,
+       .pre_exit       = nf_tables_pre_exit_net,
+       .exit           = nf_tables_exit_net,
 };
 
 static int __init nf_tables_module_init(void)