9bfd50e6dc
Use AlmaLinux OS secure boot cert
Enable Btrfs support for all kernel variants
af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361}
hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024
qla4xxx: bring back deprecated PCI ids
be2iscsi: bring back deprecated PCI ids
kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained
gve: update QPL page registration logic to honor max_registered_pages (backport from upstream)
gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream)
107 lines
3.0 KiB
Diff
107 lines
3.0 KiB
Diff
From 640441348258220e78daed40528b85b8afcedab6 Mon Sep 17 00:00:00 2001
|
|
From: Fernando Fernandez Mancera <fmancera@suse.de>
|
|
Date: Tue, 26 May 2026 23:58:31 +0200
|
|
Subject: [PATCH] netfilter: synproxy: add mutex to guard hook reference
|
|
counting
|
|
|
|
[ Upstream commit 2fcba19caaeb2a33017459d3430f057967bb91b6 ]
|
|
|
|
As the synproxy infrastructure register netfilter hooks on-demand when a
|
|
user adds the first iptables target or nftables expression, if done
|
|
concurrently they can race each other.
|
|
|
|
Introduce a mutex to serialize the refcount control blocks access from
|
|
both frontends. While a per namespace mutex might be more efficient, it
|
|
is not needed for target/expression like SYNPROXY.
|
|
|
|
Fixes: ad49d86e07a4 ("netfilter: nf_tables: Add synproxy support")
|
|
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
|
|
Signed-off-by: Florian Westphal <fw@strlen.de>
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
|
|
|
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
|
|
index 6a851ac..a277b2b 100644
|
|
--- a/net/netfilter/nf_synproxy_core.c
|
|
+++ b/net/netfilter/nf_synproxy_core.c
|
|
@@ -21,6 +21,8 @@
|
|
#include <net/netfilter/nf_conntrack_zones.h>
|
|
#include <net/netfilter/nf_synproxy.h>
|
|
|
|
+static DEFINE_MUTEX(synproxy_mutex);
|
|
+
|
|
unsigned int synproxy_net_id;
|
|
EXPORT_SYMBOL_GPL(synproxy_net_id);
|
|
|
|
@@ -768,26 +770,31 @@ static const struct nf_hook_ops ipv4_synproxy_ops[] = {
|
|
|
|
int nf_synproxy_ipv4_init(struct synproxy_net *snet, struct net *net)
|
|
{
|
|
- int err;
|
|
+ int err = 0;
|
|
|
|
+ mutex_lock(&synproxy_mutex);
|
|
if (snet->hook_ref4 == 0) {
|
|
err = nf_register_net_hooks(net, ipv4_synproxy_ops,
|
|
ARRAY_SIZE(ipv4_synproxy_ops));
|
|
if (err)
|
|
- return err;
|
|
+ goto out;
|
|
}
|
|
|
|
snet->hook_ref4++;
|
|
- return 0;
|
|
+out:
|
|
+ mutex_unlock(&synproxy_mutex);
|
|
+ return err;
|
|
}
|
|
EXPORT_SYMBOL_GPL(nf_synproxy_ipv4_init);
|
|
|
|
void nf_synproxy_ipv4_fini(struct synproxy_net *snet, struct net *net)
|
|
{
|
|
+ mutex_lock(&synproxy_mutex);
|
|
snet->hook_ref4--;
|
|
if (snet->hook_ref4 == 0)
|
|
nf_unregister_net_hooks(net, ipv4_synproxy_ops,
|
|
ARRAY_SIZE(ipv4_synproxy_ops));
|
|
+ mutex_unlock(&synproxy_mutex);
|
|
}
|
|
EXPORT_SYMBOL_GPL(nf_synproxy_ipv4_fini);
|
|
|
|
@@ -1192,27 +1199,32 @@ static const struct nf_hook_ops ipv6_synproxy_ops[] = {
|
|
int
|
|
nf_synproxy_ipv6_init(struct synproxy_net *snet, struct net *net)
|
|
{
|
|
- int err;
|
|
+ int err = 0;
|
|
|
|
+ mutex_lock(&synproxy_mutex);
|
|
if (snet->hook_ref6 == 0) {
|
|
err = nf_register_net_hooks(net, ipv6_synproxy_ops,
|
|
ARRAY_SIZE(ipv6_synproxy_ops));
|
|
if (err)
|
|
- return err;
|
|
+ goto out;
|
|
}
|
|
|
|
snet->hook_ref6++;
|
|
- return 0;
|
|
+out:
|
|
+ mutex_unlock(&synproxy_mutex);
|
|
+ return err;
|
|
}
|
|
EXPORT_SYMBOL_GPL(nf_synproxy_ipv6_init);
|
|
|
|
void
|
|
nf_synproxy_ipv6_fini(struct synproxy_net *snet, struct net *net)
|
|
{
|
|
+ mutex_lock(&synproxy_mutex);
|
|
snet->hook_ref6--;
|
|
if (snet->hook_ref6 == 0)
|
|
nf_unregister_net_hooks(net, ipv6_synproxy_ops,
|
|
ARRAY_SIZE(ipv6_synproxy_ops));
|
|
+ mutex_unlock(&synproxy_mutex);
|
|
}
|
|
EXPORT_SYMBOL_GPL(nf_synproxy_ipv6_fini);
|
|
#endif /* CONFIG_IPV6 */
|