Netdev Archive on
 help / color / Atom feed
From: Pablo Neira Ayuso <>
Subject: [PATCH 8/9] netfilter: nf_tables: fix flowtable list del corruption
Date: Thu, 16 Jan 2020 20:50:43 +0100
Message-ID: <> (raw)
In-Reply-To: <>

From: Florian Westphal <>

syzbot reported following crash:

  list_del corruption, ffff88808c9bb000->prev is LIST_POISON2 (dead000000000122)
  Call Trace:
   __list_del_entry include/linux/list.h:131 [inline]
   list_del_rcu include/linux/rculist.h:148 [inline]
   nf_tables_commit+0x1068/0x3b30 net/netfilter/nf_tables_api.c:7183

The commit transaction list has:


A missing generation check during DELTABLE processing causes it to queue
the DELFLOWTABLE operation a second time, so we corrupt the list here:


because we have two different DELFLOWTABLE transactions for the same
flowtable.  We then call list_del_rcu() twice for the same flowtable->list.

The object handling seems to suffer from the same bug so add a generation
check too and only queue delete transactions for flowtables/objects that
are still active in the next generation.

Fixes: 3b49e2e94e6eb ("netfilter: nf_tables: add flow table netlink frontend")
Signed-off-by: Florian Westphal <>
Signed-off-by: Pablo Neira Ayuso <>
 net/netfilter/nf_tables_api.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 896a6e8aff91..65f51a2e9c2a 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1048,12 +1048,18 @@ static int nft_flush_table(struct nft_ctx *ctx)
 	list_for_each_entry_safe(flowtable, nft, &ctx->table->flowtables, list) {
+		if (!nft_is_active_next(ctx->net, flowtable))
+			continue;
 		err = nft_delflowtable(ctx, flowtable);
 		if (err < 0)
 			goto out;
 	list_for_each_entry_safe(obj, ne, &ctx->table->objects, list) {
+		if (!nft_is_active_next(ctx->net, obj))
+			continue;
 		err = nft_delobj(ctx, obj);
 		if (err < 0)
 			goto out;

  parent reply index

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-01-16 19:50 [PATCH 0/9] Netfilter updates for net Pablo Neira Ayuso
2020-01-16 19:50 ` [PATCH 1/9] netfilter: fix a use-after-free in mtype_destroy() Pablo Neira Ayuso
2020-01-16 19:50 ` [PATCH 2/9] netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct Pablo Neira Ayuso
2020-01-16 19:50 ` [PATCH 3/9] netfilter: nf_tables: store transaction list locally while requesting module Pablo Neira Ayuso
2020-01-16 19:50 ` [PATCH 4/9] netfilter: nft_tunnel: fix null-attribute check Pablo Neira Ayuso
2020-01-16 19:50 ` [PATCH 5/9] netfilter: nft_tunnel: ERSPAN_VERSION must not be null Pablo Neira Ayuso
2020-01-16 19:50 ` [PATCH 6/9] netfilter: nf_tables: remove WARN and add NLA_STRING upper limits Pablo Neira Ayuso
2020-01-16 19:50 ` [PATCH 7/9] netfilter: nf_tables: fix memory leak in nf_tables_parse_netdev_hooks() Pablo Neira Ayuso
2020-01-16 19:50 ` Pablo Neira Ayuso [this message]
2020-01-16 19:50 ` [PATCH 9/9] netfilter: nat: fix ICMP header corruption on ICMP errors Pablo Neira Ayuso
2020-01-17  9:37 ` [PATCH 0/9] Netfilter updates for net David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Netdev Archive on

Archives are clonable:
	git clone --mirror netdev/git/0.git
	git clone --mirror netdev/git/1.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netdev netdev/ \
	public-inbox-index netdev

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone