• Sabrina Dubroca's avatar
    netfilter: ipt_CLUSTERIP: fix use-after-free of proc entry · 3840538a
    Sabrina Dubroca authored
    When we delete a netns with a CLUSTERIP rule, clusterip_net_exit() is
    called first, removing /proc/net/ipt_CLUSTERIP.
    Then clusterip_config_entry_put() is called from clusterip_tg_destroy(),
    and tries to remove its entry under /proc/net/ipt_CLUSTERIP/.
    
    Fix this by checking that the parent directory of the entry to remove
    hasn't already been deleted.
    
    The following triggers a KASAN splat (stealing the reproducer from
    202f59af, thanks to Jianlin Shi and Xin Long):
    
        ip netns add test
        ip link add veth0_in type veth peer name veth0_out
        ip link set veth0_in netns test
        ip netns exec test ip link set lo up
        ip netns exec test ip link set veth0_in up
        ip netns exec test iptables -I INPUT -d 1.2.3.4 -i veth0_in -j     \
            CLUSTERIP --new --clustermac 89:d4:47:eb:9a:fa --total-nodes 3 \
            --local-node 1 --hashmode sourceip-sourceport
        ip netns del test
    
    Fixes: ce4ff76c ("netfilter: ipt_CLUSTERIP: make proc directory per net namespace")
    Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
    Reviewed-by: default avatarXin Long <lucien.xin@gmail.com>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    3840538a
ipt_CLUSTERIP.c 20.8 KB