[Devel] [PATCH VZ7 0/7] netfilter: ipset: Fix possible cause of memory corruption

[Pavel Tikhomirov]

Patch [1] fixes possible race between swap/destroy and add/del/test.

Here is is possible order of events when this race can lead to double
free with kfree_rcu on already freed hash bucket:

# Thread 1
  +-> ip_set_add
    +-> set = ip_set_rcu_get(xt_net(par), index)
    < pause >

# Thread 2
ipset swap
ipset destroy
  +-> mtype_destroy
    +-> mtype_ahash_destroy
      +-> n = __ipset_dereference(hbucket(t, i))
      +-> kfree(n)

# Thread 1
    < unpause >
    +-> ip_set_lock(set)
    +-> hash_net4_kadt
      +-> mtype_variant->adt[adt]
        +-> net4_kadt_add (mtype_add)
          +-> n = rcu_dereference_bh(hbucket(t, key))
          +-> if (n->pos >= n->size)
            +-> old = n
          +-> if (old != ERR_PTR(-ENOENT))
            +-> kfree_rcu(old, rcu)

That can in it's turn lead to possible rcu free list corruption if this
double fried memory is reused just after rcu_free and before actual rcu
callback.

note1: The patch [1] has a reproducer but, sadly, I was unable to
reproduce the situation, even adding mdelay(100) to ip_set_add/del/test.

note2: All other patches are fixups to the original fixing patch.

note3: We don't have proof that this a fix to original issue, we only
know that ipset hash buckets were several times seen double freed just
before crash, which might indirectly indicate that the original problem
is related to ipset hash buckets.

Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
https://virtuozzo.atlassian.net/browse/PSBM-155867

Alexander Maltsev (1):
  netfilter: ipset: Add list flush to cancel_gc

Eric Dumazet (1):
  netns: add pre_exit method to struct pernet_operations

Jozsef Kadlecsik (5):
  netfilter: ipset: fix race condition between swap/destroy and kernel
    side add/del/test [1]
  netfilter: ipset: fix performance regression in swap operation
  netfilter: ipset: Missing gc cancellations fixed
  netfilter: ipset: Fix race between namespace cleanup and gc in the
    list:set type
  netfilter: ipset: Fix suspicious rcu_dereference_protected()

 include/linux/netfilter/ipset/ip_set.h  |   4 +
 include/net/net_namespace.h             |   6 ++
 net/core/net_namespace.c                |  28 ++++++
 net/netfilter/ipset/ip_set_bitmap_gen.h |  14 ++-
 net/netfilter/ipset/ip_set_core.c       | 119 +++++++++++++++---------
 net/netfilter/ipset/ip_set_hash_gen.h   |  19 +++-
 net/netfilter/ipset/ip_set_list_set.c   |  46 +++++----
 7 files changed, 166 insertions(+), 70 deletions(-)

-- 
2.46.0