netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()

jira LE-1907
cve CVE-2024-27019
Rebuild_History Non-Buildable kernel-4.18.0-553.16.1.el8_10
commit-author Ziyang Xuan <[email protected]>
commit d78d867
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-4.18.0-553.16.1.el8_10/d78d867d.failed

nft_unregister_obj() can concurrent with __nft_obj_type_get(),
and there is not any protection when iterate over nf_tables_objects
list in __nft_obj_type_get(). Therefore, there is potential data-race
of nf_tables_objects list entry.

Use list_for_each_entry_rcu() to iterate over nf_tables_objects
list in __nft_obj_type_get(), and use rcu_read_lock() in the caller
nft_obj_type_get() to protect the entire type query process.

Fixes: e500924 ("netfilter: nf_tables: add stateful objects")
	Signed-off-by: Ziyang Xuan <[email protected]>
	Signed-off-by: Pablo Neira Ayuso <[email protected]>
(cherry picked from commit d78d867)
	Signed-off-by: Jonathan Maple <[email protected]>

# Conflicts:
#	net/netfilter/nf_tables_api.c

Author: PlaidCat

ciq/ciq_backports/kernel-4.18.0-553.16.1.el8_10/d78d867d.failed

@@ -0,0 +1,68 @@
+netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
+
+jira LE-1907
+cve CVE-2024-27019
+Rebuild_History Non-Buildable kernel-4.18.0-553.16.1.el8_10
+commit-author Ziyang Xuan <[email protected]>
+commit d78d867dcea69c328db30df665be5be7d0148484
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-4.18.0-553.16.1.el8_10/d78d867d.failed
+
+nft_unregister_obj() can concurrent with __nft_obj_type_get(),
+and there is not any protection when iterate over nf_tables_objects
+list in __nft_obj_type_get(). Therefore, there is potential data-race
+of nf_tables_objects list entry.
+
+Use list_for_each_entry_rcu() to iterate over nf_tables_objects
+list in __nft_obj_type_get(), and use rcu_read_lock() in the caller
+nft_obj_type_get() to protect the entire type query process.
+
+Fixes: e50092404c1b ("netfilter: nf_tables: add stateful objects")
+	Signed-off-by: Ziyang Xuan <[email protected]>
+	Signed-off-by: Pablo Neira Ayuso <[email protected]>
+(cherry picked from commit d78d867dcea69c328db30df665be5be7d0148484)
+	Signed-off-by: Jonathan Maple <[email protected]>
+
+# Conflicts:
+#	net/netfilter/nf_tables_api.c
+diff --cc net/netfilter/nf_tables_api.c
+index abc82fddd260,f11d0c0a2c73..000000000000
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@@ -6135,7 -7611,11 +6135,15 @@@ static const struct nft_object_type *__
+  {
+  	const struct nft_object_type *type;
+  
+++<<<<<<< HEAD
+ +	list_for_each_entry(type, &nf_tables_objects, list) {
+++=======
++ 	list_for_each_entry_rcu(type, &nf_tables_objects, list) {
++ 		if (type->family != NFPROTO_UNSPEC &&
++ 		    type->family != family)
++ 			continue;
++ 
+++>>>>>>> d78d867dcea6 (netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get())
+  		if (objtype == type->type)
+  			return type;
+  	}
+@@@ -6147,9 -7627,13 +6155,18 @@@ nft_obj_type_get(struct net *net, u32 o
+  {
+  	const struct nft_object_type *type;
+  
+++<<<<<<< HEAD
+ +	type = __nft_obj_type_get(objtype);
+ +	if (type != NULL && try_module_get(type->owner))
+++=======
++ 	rcu_read_lock();
++ 	type = __nft_obj_type_get(objtype, family);
++ 	if (type != NULL && try_module_get(type->owner)) {
++ 		rcu_read_unlock();
+++>>>>>>> d78d867dcea6 (netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get())
+  		return type;
++ 	}
++ 	rcu_read_unlock();
+  
+  	lockdep_nfnl_nft_mutex_not_held();
+  #ifdef CONFIG_MODULES
+* Unmerged path net/netfilter/nf_tables_api.c