From: Florian Westphal fw@strlen.de
commit 8b26ff7af8c32cb4148b3e147c52f9e4c695209c upstream.
We must put 'sk' reference before returning.
Fixes: 039b1f4f24ec ("netfilter: nft_socket: fix erroneous socket assignment") Signed-off-by: Florian Westphal fw@strlen.de Signed-off-by: Pablo Neira Ayuso pablo@netfilter.org [Denis: minor fix to resolve merge conflict.] Signed-off-by: Denis Arefev arefev@swemel.ru --- Backport fix for CVE-2024-46855 Link: https://nvd.nist.gov/vuln/detail/CVE-2024-46855 --- net/netfilter/nft_socket.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c index 826e5f8c78f3..07e73e50b713 100644 --- a/net/netfilter/nft_socket.c +++ b/net/netfilter/nft_socket.c @@ -88,13 +88,13 @@ static void nft_socket_eval(const struct nft_expr *expr, *dest = sk->sk_mark; } else { regs->verdict.code = NFT_BREAK; - return; + goto out_put_sk; } break; case NFT_SOCKET_WILDCARD: if (!sk_fullsock(sk)) { regs->verdict.code = NFT_BREAK; - return; + goto out_put_sk; } nft_socket_wildcard(pkt, regs, sk, dest); break; @@ -103,6 +103,7 @@ static void nft_socket_eval(const struct nft_expr *expr, regs->verdict.code = NFT_BREAK; }
+out_put_sk: if (sk != skb->sk) sock_gen_put(sk); }
[ Sasha's backport helper bot ]
Hi,
✅ All tests passed successfully. No issues detected. No action required from the submitter.
The upstream commit SHA1 provided is correct: 8b26ff7af8c32cb4148b3e147c52f9e4c695209c
WARNING: Author mismatch between patch and upstream commit: Backport author: Denis Arefevarefev@swemel.ru Commit author: Florian Westphalfw@strlen.de
Status in newer kernel trees: 6.15.y | Present (exact SHA1) 6.14.y | Present (exact SHA1) 6.12.y | Present (exact SHA1) 6.6.y | Present (different SHA1: 83e6fb59040e) 6.1.y | Present (different SHA1: 33c2258bf8cb) 5.15.y | Present (different SHA1: ddc7c423c4a5)
Note: The patch differs from the upstream commit: --- 1: 8b26ff7af8c32 ! 1: a2677efdc7b71 netfilter: nft_socket: fix sk refcount leaks @@ Metadata ## Commit message ## netfilter: nft_socket: fix sk refcount leaks
+ commit 8b26ff7af8c32cb4148b3e147c52f9e4c695209c upstream. + We must put 'sk' reference before returning.
Fixes: 039b1f4f24ec ("netfilter: nft_socket: fix erroneous socket assignment") Signed-off-by: Florian Westphal fw@strlen.de Signed-off-by: Pablo Neira Ayuso pablo@netfilter.org + [Denis: minor fix to resolve merge conflict.] + Signed-off-by: Denis Arefev arefev@swemel.ru
## net/netfilter/nft_socket.c ## @@ net/netfilter/nft_socket.c: static void nft_socket_eval(const struct nft_expr *expr, - *dest = READ_ONCE(sk->sk_mark); + *dest = sk->sk_mark; } else { regs->verdict.code = NFT_BREAK; - return; @@ net/netfilter/nft_socket.c: static void nft_socket_eval(const struct nft_expr *e } nft_socket_wildcard(pkt, regs, sk, dest); break; -@@ net/netfilter/nft_socket.c: static void nft_socket_eval(const struct nft_expr *expr, - case NFT_SOCKET_CGROUPV2: - if (!nft_sock_get_eval_cgroupv2(dest, sk, pkt, priv->level)) { - regs->verdict.code = NFT_BREAK; -- return; -+ goto out_put_sk; - } - break; - #endif @@ net/netfilter/nft_socket.c: static void nft_socket_eval(const struct nft_expr *expr, regs->verdict.code = NFT_BREAK; } ---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-5.10.y | Success | Success |
On Mon, Jun 02, 2025 at 03:39:47PM +0300, Denis Arefev wrote:
From: Florian Westphal fw@strlen.de
commit 8b26ff7af8c32cb4148b3e147c52f9e4c695209c upstream.
We must put 'sk' reference before returning.
I have a backport for 5.4 in the queue, I will take care of this.
Thanks.
linux-stable-mirror@lists.linaro.org
-
Denis Arefev -
Pablo Neira Ayuso -
Sasha Levin