netdev - Re: [PATCH v1 0/4] iptables: Module unload causing NULL pointer reference.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20200624120549.GA27711@salvia>
Date:   Wed, 24 Jun 2020 14:05:49 +0200
From:   Pablo Neira Ayuso <pablo@...filter.org>
To:     David Wilder <dwilder@...ibm.com>
Cc:     netdev@...r.kernel.org, netfilter-devel@...r.kernel.org,
        fw@...len.de, wilder@...ibm.com, mkubecek@...e.com
Subject: Re: [PATCH v1 0/4] iptables: Module unload causing NULL pointer
 reference.

On Mon, Jun 22, 2020 at 10:10:10AM -0700, David Wilder wrote:
> A crash happened on ppc64le when running ltp network tests triggered by "rmmod iptable_mangle".
> 
> See previous discussion in this thread: https://lists.openwall.net/netdev/2020/06/03/161 .
> 
> In the crash I found in iptable_mangle_hook() that state->net->ipv4.iptable_mangle=NULL causing a NULL pointer dereference. net->ipv4.iptable_mangle is set to NULL in iptable_mangle_net_exit() and called when ip_mangle modules is unloaded. A rmmod task was found running in the crash dump.  A 2nd crash showed the same problem when running "rmmod iptable_filter" (net->ipv4.iptable_filter=NULL).
> 
> To fix this I added .pre_exit hook in all iptable_foo.c. The pre_exit will un-register the underlying hook and exit would do the table freeing. The netns core does an unconditional synchronize_rcu after the pre_exit hooks insuring no packets are in flight that have picked up the pointer before completing the un-register.
> 
> These patches include changes for both iptables and ip6tables.
> 
> We tested this fix with ltp running iptables01.sh and iptables01.sh -6 a loop for 72 hours.

Series applied, thanks.