Skip to content

Commit c2e9b8c

Browse files
committed
netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
jira VULN-4905 cve CVE-2024-26925 commit-author Pablo Neira Ayuso <[email protected]> commit 0d459e2 The commit mutex should not be released during the critical section between nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC worker could collect expired objects and get the released commit lock within the same GC sequence. nf_tables_module_autoload() temporarily releases the mutex to load module dependencies, then it goes back to replay the transaction again. Move it at the end of the abort phase after nft_gc_seq_end() is called. Cc: [email protected] Fixes: 7203443 ("netfilter: nf_tables: GC transaction race with abort path") Reported-by: Kuan-Ting Chen <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]> (cherry picked from commit 0d459e2) Signed-off-by: Greg Rose <[email protected]>
1 parent 6fb4d40 commit c2e9b8c

File tree

1 file changed

+0
-5
lines changed

1 file changed

+0
-5
lines changed

net/netfilter/nf_tables_api.c

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8613,11 +8613,6 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
86138613
nf_tables_abort_release(trans);
86148614
}
86158615

8616-
if (action == NFNL_ABORT_AUTOLOAD)
8617-
nf_tables_module_autoload(net);
8618-
else
8619-
nf_tables_module_autoload_cleanup(net);
8620-
86218616
return err;
86228617
}
86238618

0 commit comments

Comments
 (0)