From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f46.google.com (mail-wr1-f46.google.com [209.85.221.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 00C493D16EC for ; Fri, 1 May 2026 20:41:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777668070; cv=none; b=SH3IZ59mRgUA1Rx5Exh4Aw8Kz+vijYLrI2SYTKD1P2gk2KpWFb4IHWXV9xBF0t6Ib/Jm/LGf1uQZRol+ldAQlZ+brYe43Z76ertk93ZDfHEy6BHBcAYkXke/hqaQAYe5f9NAIlPKQx6mmt1fnlJTTwwHYwPVls5kHGVuGM7MIH8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777668070; c=relaxed/simple; bh=VAGwlkfOhO8vq5+QQLvGj7XDBS7ATS4VX2eI2mgwUus=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=sfAGsgMSGnyS+Ag2BL84B2MX2c6y80Sz1StDi+4ns9potvBkIPXEsoqJ1BOgDcErckcw4ezXClmPYP/ugaTgUI69uYoQeM0EJvB3qFNaUp5ktUUzlRkLM9+qWZmEltErtgoIO4quWsbjA23/DpOf62R6+CTlLHBGzi6yUue8ZAo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=qEi8ltVY; arc=none smtp.client-ip=209.85.221.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="qEi8ltVY" Received: by mail-wr1-f46.google.com with SMTP id ffacd0b85a97d-44509921fbcso1210344f8f.3 for ; Fri, 01 May 2026 13:41:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1777668067; x=1778272867; darn=vger.kernel.org; h=mime-version:content-transfer-encoding:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=VAGwlkfOhO8vq5+QQLvGj7XDBS7ATS4VX2eI2mgwUus=; b=qEi8ltVY5FPEkzaV0Cs9mYwRsvjaa8SVo60MZY0QFhFnG6FzppCD07Ig8oFLUFCBbH puGD2nsRT7C5GnHb//5Az6G1obFAXi/gAlcuPX8h9ntj0DNsW1CZeuKAALjO/Hhvac9t FmBk6RXdOlM0X+r/1iwngpC8pEKFe3FcIgyaoOwCO1ZGBj1EEZ9zl+Hz4AKfVdVllvM5 qpXddun6F14obLU40djU92xYXpovRtbDpeaj2SYRk/FcztH1pkcPdosmgEDdi+YQ5mWx hHx/qpD1IQIGBBInApPHgk5mPsFY6kuiyqmAWxbbfBETeq3dCSihVsbftqa28pXx+Y1/ a6KQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777668067; x=1778272867; h=mime-version:content-transfer-encoding:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=VAGwlkfOhO8vq5+QQLvGj7XDBS7ATS4VX2eI2mgwUus=; b=P+sP2we1PQ8J3fg7+yY5JzFFz1z8zM2rNkZuowbS4afwZmpB9WCoEnGBzTfaljns+F 04SoWet0fNip/GgSieXnUD6EptMr6YKlCfflhvPcDoaBE5BCKP4d2GS9tzCE+5YPRxr6 ruA7CkaqbQ88Uv1diOMM2zjt3q/VpAzcY6zxx5AcZBWSpNr6juVL5c24Kd5cJEuaKesH GlH1hn2RAcXRq9thmZQ9g/YEt2Id1Opq2ueSP4fK1qHh+PDKvLTyzFDegxzjH6fFRLk1 6yOA5iwMr+ycnqFbMc2GqPhVrIO2PCBx3TF6wYeARt2zxRyjjK6rUh/akTohcK5w71LJ UIyw== X-Forwarded-Encrypted: i=1; AFNElJ9DuhQU5rPdoxzUIiY1dqUq6x8GC79932sDxddTG2Gou97Enfi3aJUlBw6vDIW2cIEyBwTXLEWkGzqnYis=@vger.kernel.org X-Gm-Message-State: AOJu0YyGd9H+K9lJYiqASEqa1egmWdAYWozf/MQSOrxUDLyVOLa4YRax +ysTphE2GNTX9i/pNx7UGmwevOE5e7tGE2Qh0bH+K3tAp0QaACMaxsHNbo1PAms= X-Gm-Gg: AeBDietnC2MyAH5WlCmwqceXVfBfQDSlyXyxKGvUOl/Jey6jOm+Ky0L2yvZD7ycC8RF 8QV+sNFOJfbrCmwWD/ZiIqkRqGkztAl+dG34SucH+Z3NSiL6wZMl6dEF2sbf3yJvW+nWZT+T6EV PjqR02wpms4P60FK5jwVGjrzgg1v8PRQdigm+vGj7nlvVYqdQ/1ZOYAuegXPB6wzY4DDndrIJdy gpRZ/B09aDWhc9jMMoBhemsfxfsPusBVpRZdKRPyUMAq3nhrmZDlt2WN7UA3Jx4jV3d6wwcQP/X bAB/M5vAH3GJ2xsoeJ0B1NaFYmu+cJgM/kYMQn+xFK20EJKeSE8RURaK2KWc37ok3jprfcqp44q vXHZouQ0HJkNp4W1WrcM4ilLDkkU0h0E/hcb+fpYK+AyzNIPnVaU5tCZgmwH3vUx4JW6xb+zQ0z G0al4tE8A7KqA= X-Received: by 2002:a05:6000:2383:b0:43d:c95c:4259 with SMTP id ffacd0b85a97d-44bb5b4e054mr1421092f8f.30.1777668067195; Fri, 01 May 2026 13:41:07 -0700 (PDT) Received: from debian ([2001:41d0:303:db6b::]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-44a986aa3a5sm7882383f8f.26.2026.05.01.13.41.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 01 May 2026 13:41:06 -0700 (PDT) From: Tristan Madani To: Florian Westphal Cc: Pablo Neira Ayuso , Phil Sutter , netfilter-devel@vger.kernel.org, netdev@vger.kernel.org, stable@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v2 1/2] netfilter: ip_tables: guard ipt_unregister_table_pre_exit against NULL ops Date: Fri, 01 May 2026 20:41:05 -0000 Message-ID: <177766806589.1898033.5646188235412407059@gmail.com> In-Reply-To: References: <20260429175613.1459342-1-tristmd@gmail.com> <177750472539.3004201.15967003942391945312@talencesecurity.com> <177750474339.3016150.13196470704394042910@talencesecurity.com> <177758578919.118018.11758358602621428742@gmail.com> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 On Thu, 1 May 2026 Florian Westphal wrote: > If we have races between a thread calling ipt_register_table > and the netns cleanup path there is nothing we could ever do to > fix it: we are tearing down a live network namespace. > Something else must be going on. I agree, this one is unusual. I tried multiple PoC approaches without success -- all I have is the syzkaller crash I shared, no reliable reproducer. Syzkaller itself could not minimize it either. That said, the crash is real -- KASAN shows ops=NULL in pre_exit during cleanup_net -- so something is reaching that path. The V2 guard handles it regardless of the root cause: if ops is NULL in pre_exit, we should not pass it to nf_unregister_net_hooks. I will share any PoC/repro if I get one. Thanks, Tristan