netfilter: nf_tables: netlink notifier might race to release objects

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2134544
Upstream Status: commit d4bc827

commit d4bc827
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Wed Oct 26 09:52:36 2022 +0200

    netfilter: nf_tables: netlink notifier might race to release objects

    commit release path is invoked via call_rcu and it runs lockless to
    release the objects after rcu grace period. The netlink notifier handler
    might win race to remove objects that the transaction context is still
    referencing from the commit release path.

    Call rcu_barrier() to ensure pending rcu callbacks run to completion
    if the list of transactions to be destroyed is not empty.

    Fixes: 6001a93 ("netfilter: nftables: introduce table ownership")
    Reported-by: syzbot+8f747f62763bc6c32916@syzkaller.appspotmail.com
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Signed-off-by: Florian Westphal <fwestpha@redhat.com>

Author: fw-strlen

net/netfilter/nf_tables_api.c

@@ -9824,6 +9824,8 @@ static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event,
 	nft_net = nft_pernet(net);
 	deleted = 0;
 	mutex_lock(&nft_net->commit_mutex);
+	if (!list_empty(&nf_tables_destroy_list))
+		rcu_barrier();
 again:
 	list_for_each_entry(table, &nft_net->tables, list) {
 		if (nft_table_has_owner(table) &&