target/linux/generic/pending-5.10/706-netfilter-nf_flow_table-add-missing-locking.patch

   1 From: Felix Fietkau <nbd@nbd.name>
   2 Date: Sat, 19 Nov 2022 18:48:42 +0100
   3 Subject: [PATCH] netfilter: nf_flow_table: add missing locking
   4
   5 nf_flow_table_block_setup and the driver TC_SETUP_FT call can modify the flow
   6 block cb list while they are being traversed elsewhere, causing a crash.
   7 Add a write lock around the calls to protect readers
   8
   9 Signed-off-by: Felix Fietkau <nbd@nbd.name>
  10 ---
  11
  12 --- a/net/netfilter/nf_flow_table_offload.c
  13 +++ b/net/netfilter/nf_flow_table_offload.c
  14 @@ -1015,6 +1015,7 @@ static int nf_flow_table_block_setup(str
  15         struct flow_block_cb *block_cb, *next;
  16         int err = 0;
  17
  18 +       down_write(&flowtable->flow_block_lock);
  19         switch (cmd) {
  20         case FLOW_BLOCK_BIND:
  21                 list_splice(&bo->cb_list, &flowtable->flow_block.cb_list);
  22 @@ -1029,6 +1030,7 @@ static int nf_flow_table_block_setup(str
  23                 WARN_ON_ONCE(1);
  24                 err = -EOPNOTSUPP;
  25         }
  26 +       up_write(&flowtable->flow_block_lock);
  27
  28         return err;
  29  }
  30 @@ -1085,7 +1087,9 @@ static int nf_flow_table_offload_cmd(str
  31
  32         nf_flow_table_block_offload_init(bo, dev_net(dev), cmd, flowtable,
  33                                          extack);
  34 +       down_write(&flowtable->flow_block_lock);
  35         err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_FT, bo);
  36 +       up_write(&flowtable->flow_block_lock);
  37         if (err < 0)
  38                 return err;
  39