path: root/libxtables
diff options
authorPhil Sutter <>2020-03-13 13:02:12 +0100
committerPhil Sutter <>2020-03-16 13:15:15 +0100
commit200bc399651499f502ac0de45f4d4aa4c9d37ab6 (patch)
tree4bbe6e69eb187c4ad5a3d7e69c9a938bf3651252 /libxtables
parenta8afaf7c762e247637fa9c027ed7d81a692f08ec (diff)
nft: cache: Fix iptables-save segfault under stress
If kernel ruleset is constantly changing, code called by nft_is_table_compatible() may crash: For each item in table's chain list, nft_is_chain_compatible() is called. This in turn calls nft_build_cache() to fetch chain's rules. Though if kernel genid has changed meanwhile, cache is flushed and rebuilt from scratch, thereby freeing table's chain list - the foreach loop in nft_is_table_compatible() then operates on freed memory. A simple reproducer (may need a few calls): | RULESET='*filter | :INPUT ACCEPT [10517:1483527] | :FORWARD ACCEPT [0:0] | :OUTPUT ACCEPT [1714:105671] | COMMIT | ' | | for ((i = 0; i < 100; i++)); do | iptables-nft-restore <<< "$RULESET" & | done & | iptables-nft-save To fix the problem, basically revert commit ab1cd3b510fa5 ("nft: ensure cache consistency") so that __nft_build_cache() no longer flushes the cache. Instead just record kernel's genid when fetching for the first time. If kernel rule set changes until the changes are committed, the commit simply fails and local cache is being rebuilt. Signed-off-by: Phil Sutter <>
Diffstat (limited to 'libxtables')
0 files changed, 0 insertions, 0 deletions