Re: [PATCH 6.1 1/2] netfilter: nf_tables: allow to create netdev chain without device

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

On Fri, Oct 02, 2026 at 05:10:34PM -0400, Sasha Levin wrote:
> > This is a 6.1 backport of upstream commit 207296f1a03b; the hunk for
> > nft_delchain_hook() is dropped since that function is not present in 6.1.
> 
> This series only brings in the prerequisites. The UAF fix itself isn't
> in it:
> 
>   fc0133428e7a ("netfilter: nf_tables: Tolerate chains with no remaining hooks")
>   375f222800bc ("netfilter: nf_tables: Simplify chain netdev notifier")
> 
> 2/2 also adds b9703ed44ffb ("netfilter: nf_tables: support for adding
> new devices to an existing netdev chain") to 6.1 without the later
> fixes for it, none of which 6.1 has:
> 
>   043d2acf5722 ("netfilter: nf_tables: drop module reference after updating chain")
>   7eaf837a4eb5 ("netfilter: nf_tables: Fix a memory leak in nf_tables_updchain")
>   1e1fb6f00f52 ("netfilter: nf_tables: reject table flag and netdev basechain updates")
>   216e7bf7402c ("netfilter: nf_tables: skip netdev hook unregistration if table is dormant")
>   688c15017d5c ("netfilter: nf_tables: don't unregister hook when table is dormant")
>   4ffcf5ca81c3 ("netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path")
> 
> It also needs the netdev chain parts of a6134e62dba2 ("netfilter:
> nf_tables: join hook list via splice_list_rcu() in commit phase") and
> cf5fb87fcdaa ("netfilter: nf_tables: reject duplicate device on
> updates"); 6.1 only has their flowtable parts. Without 043d2acf5722,
> every base chain update that carries a hook leaks a reference on the
> chain type module.
> 
> Could you send a single 6.1 series in upstream order: the two
> prerequisites, the fixes above, then fc0133428e7a and 375f222800bc?
> Please start each patch with its "commit <sha> upstream." line and add
> a cover letter. An ack from Pablo or Florian would help too.
> 
> 5.15 and 5.10 have the same UAF. Are you planning to cover them as well?

Yes, I am collecting backport patches and preparing a batch for you.