tree ac3b03eeef2dd586c82b306d7804770b768fa217
parent a7537d805f405f86617355ac6fab708fc2a4d95a
author Pablo Neira Ayuso <pablo@netfilter.org> 1709558532 +0100
committer COS Cherry Picker <cloud-image-release@prod.google.com> 1713063841 -0700

netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout

commit 552705a3650bbf46a22b1adedc1b04181490fc36 upstream.

While the rhashtable set gc runs asynchronously, a race allows it to
collect elements from anonymous sets with timeouts while it is being
released from the commit path.

Mingi Cho originally reported this issue in a different path in 6.1.x
with a pipapo set with low timeouts which is not possible upstream since
7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set
element timeout").

Fix this by setting on the dead flag for anonymous sets to skip async gc
in this case.

According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on
transaction abort"), Florian plans to accelerate abort path by releasing
objects via workqueue, therefore, this sets on the dead flag for abort
path too.

Cc: stable@vger.kernel.org
Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane")
Reported-by: Mingi Cho <mgcho.minic@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

BUG=b/333551897
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2024-26642,CVE-2024-26643 in the Linux kernel.

cos-patch: security-moderate
Change-Id: I5c24689c4b14ffb52b32501e16413287c84867a3
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/69140
Main-Branch-Verified: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Oleksandr Tymoshenko <ovt@google.com>