tree 20a2ad63c540d09461ebbd96847db295fb9d9f63
parent 2feb41c150c42ea8461d17464941fdc9d5694546
author Pablo Neira Ayuso <pablo@netfilter.org> 1712611113 +0200
committer Oleksandr Tymoshenko <ovt@google.com> 1714179333 +0000

netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path

commit 0d459e2ffb541841714839e8228b845458ed3b27 upstream.

The commit mutex should not be released during the critical section
between nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC
worker could collect expired objects and get the released commit lock
within the same GC sequence.

nf_tables_module_autoload() temporarily releases the mutex to load
module dependencies, then it goes back to replay the transaction again.
Move it at the end of the abort phase after nft_gc_seq_end() is called.

BUG=b/336270036
TEST=presubmit
RELEASE_NOTE=None

cos-patch: security-high
Cc: stable@vger.kernel.org
Fixes: 720344340fb9 ("netfilter: nf_tables: GC transaction race with abort path")
Reported-by: Kuan-Ting Chen <hexrabbit@devco.re>
Change-Id: I7d75f79cce4987e1e34eac59053dffa7ff924e49
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/70553
Reviewed-by: Arnav Kansal <rnv@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>