CVE-2024-50212

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> lib: alloc_tag_module_unload must wait for pending kfree_rcu calls<br /> <br /> Ben Greear reports following splat:<br /> ------------[ cut here ]------------<br /> net/netfilter/nf_nat_core.c:1114 module nf_nat func:nf_nat_register_fn has 256 allocated at module unload<br /> WARNING: CPU: 1 PID: 10421 at lib/alloc_tag.c:168 alloc_tag_module_unload+0x22b/0x3f0<br /> Modules linked in: nf_nat(-) btrfs ufs qnx4 hfsplus hfs minix vfat msdos fat<br /> ...<br /> Hardware name: Default string Default string/SKYBAY, BIOS 5.12 08/04/2020<br /> RIP: 0010:alloc_tag_module_unload+0x22b/0x3f0<br /> codetag_unload_module+0x19b/0x2a0<br /> ? codetag_load_module+0x80/0x80<br /> <br /> nf_nat module exit calls kfree_rcu on those addresses, but the free<br /> operation is likely still pending by the time alloc_tag checks for leaks.<br /> <br /> Wait for outstanding kfree_rcu operations to complete before checking<br /> resolves this warning.<br /> <br /> Reproducer:<br /> unshare -n iptables-nft -t nat -A PREROUTING -p tcp<br /> grep nf_nat /proc/allocinfo # will list 4 allocations<br /> rmmod nft_chain_nat<br /> rmmod nf_nat # will WARN.<br /> <br /> [akpm@linux-foundation.org: add comment]