Re: [PATCH 6.1 1/2] netfilter: nf_tables: allow to create netdev chain without device

[Sasha Levin]

> This is a 6.1 backport of upstream commit 207296f1a03b; the hunk for
> nft_delchain_hook() is dropped since that function is not present in 6.1.

This series only brings in the prerequisites. The UAF fix itself isn't
in it:

  fc0133428e7a ("netfilter: nf_tables: Tolerate chains with no remaining hooks")
  375f222800bc ("netfilter: nf_tables: Simplify chain netdev notifier")

2/2 also adds b9703ed44ffb ("netfilter: nf_tables: support for adding
new devices to an existing netdev chain") to 6.1 without the later
fixes for it, none of which 6.1 has:

  043d2acf5722 ("netfilter: nf_tables: drop module reference after updating chain")
  7eaf837a4eb5 ("netfilter: nf_tables: Fix a memory leak in nf_tables_updchain")
  1e1fb6f00f52 ("netfilter: nf_tables: reject table flag and netdev basechain updates")
  216e7bf7402c ("netfilter: nf_tables: skip netdev hook unregistration if table is dormant")
  688c15017d5c ("netfilter: nf_tables: don't unregister hook when table is dormant")
  4ffcf5ca81c3 ("netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path")

It also needs the netdev chain parts of a6134e62dba2 ("netfilter:
nf_tables: join hook list via splice_list_rcu() in commit phase") and
cf5fb87fcdaa ("netfilter: nf_tables: reject duplicate device on
updates"); 6.1 only has their flowtable parts. Without 043d2acf5722,
every base chain update that carries a hook leaks a reference on the
chain type module.

Could you send a single 6.1 series in upstream order: the two
prerequisites, the fixes above, then fc0133428e7a and 375f222800bc?
Please start each patch with its "commit <sha> upstream." line and add
a cover letter. An ack from Pablo or Florian would help too.

5.15 and 5.10 have the same UAF. Are you planning to cover them as well?

-- 
Thanks,
Sasha