Re: [PATCH 5.10.y] netfilter: nf_tables: make nft_object rhltable per table
Sasha Levin <[email protected]>
| Newsgroups | gmane.linux.kernel.stable,gmane.comp.security.firewalls.netfilter.devel,gmane.linux.network |
|---|---|
| Message-ID | <[email protected]> |
> The nft_object rhltable is global, this allows for accessing objects > that are being dismangled from lookup path by other existing netns. > Given the nft_obj_destroy() releases the object inmediately, this might > lead to use-after-free of these objects that are being released. > Make the existing rhltable per table to address this issue to deal with Queued for 5.10, thanks. -- Thanks, Sasha