[PATCH][Groovy] netfilter: x_tables: Use correct memory barriers.

[Tim Gardner]

From: Mark Tomlinson <mark.tomlinson at alliedtelesis.co.nz>

CVE-2021-29650

When a new table value was assigned, it was followed by a write memory
barrier. This ensured that all writes before this point would complete
before any writes after this point. However, to determine whether the
rules are unused, the sequence counter is read. To ensure that all
writes have been done before these reads, a full memory barrier is
needed, not just a write memory barrier. The same argument applies when
incrementing the counter, before the rules are read.

Changing to using smp_mb() instead of smp_wmb() fixes the kernel panic
reported in cc00bcaa5899 (which is still present), while still
maintaining the same speed of replacing tables.

The smb_mb() barriers potentially slow the packet path, however testing
has shown no measurable change in performance on a 4-core MIPS64
platform.

Fixes: 7f5c6d4f665b ("netfilter: get rid of atomic ops in fast path")
Signed-off-by: Mark Tomlinson <mark.tomlinson at alliedtelesis.co.nz>
Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
(backported from commit 175e476b8cdf2a4de7432583b49c871345e4f8a1)
[rtg - commit b4fe99107754849658d98f8353b1638202984f0f ("netfilter: x_tables:
Switch synchronization to RCU") removed the need for the full memory barrier
in net/netfilter/x_tables.c xt_replace_table(). This commit was reverted in
v5.12 ]
Signed-off-by: Tim Gardner <tim.gardner at canonical.com>
---
 include/linux/netfilter/x_tables.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 9f2cad260deb..d7c422d9e843 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -376,7 +376,7 @@ static inline unsigned int xt_write_recseq_begin(void)
 	 * since addend is most likely 1
 	 */
 	__this_cpu_add(xt_recseq.sequence, addend);
-	smp_wmb();
+	smp_mb();
 
 	return addend;
 }
-- 
2.17.1