From d3950004ba90350bcdf414c5f804da277178564a Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Wed, 9 Sep 2026 11:34:55 +0200 Subject: netfilter: nfnetlink: Fix for interrupted hook dumps Handling of concurrent hook changes with a dump in progress was problematic in nfnl_hook_dump and entirely broken in nfnl_hook_dump_nat. Address all issues in a single patch to please the review LLM. Introduce sequence numbers in struct netns_nf to replace pointer value-based modification detection which may fail due to memory buffer reuse. This also eliminates the need for most manual cb->seq updates and excessive array index value checks. Since nat hook updates are protected by a different mutex than others, they have to bump their own sequence number. nfnl_hook_dump_nat therefore open-codes what nl_dump_check_consistent does but bumps cb->seq instead of setting NLM_F_DUMP_INTR flag. Dumps of many nat hooks was entirely broken since the array index was not (re)stored. Use cb->args[1] for that and make sure it is reset upon completion as the same dump may loop over multiple arrays of nat hooks. In nfnl_hook_dump, don't signal NLM_F_DUMP_INTR if nfnl_hook_entries_head returns error: This is a permanent condition which does not change during a dump. It is already caught by nfnl_hook_dump_start though, so should not happen anyway. In general, access ops array pointer values using READ_ONCE since they are assigned to using WRITE_ONCE. Avoid setting NLM_F_DUMP_INTR flag in garbage memory by calling nl_dump_check_consistent only for non-empty skbs. If not a single netlink message was created, nfnetlink code will take care of setting the flag. Fixes: e2cf17d3774c ("netfilter: add new hook nfnl subsystem") Fixes: b010e2a4a9ac ("netfilter: nfnetlink_hook: Dump nat type chains") Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso --- include/net/netns/netfilter.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include') diff --git a/include/net/netns/netfilter.h b/include/net/netns/netfilter.h index a6a0bf4a247e..7fd78394d1e7 100644 --- a/include/net/netns/netfilter.h +++ b/include/net/netns/netfilter.h @@ -33,5 +33,7 @@ struct netns_nf { #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) unsigned int defrag_ipv6_users; #endif + unsigned int hook_base_seq; + unsigned int nat_hook_base_seq; }; #endif -- cgit v1.2.3