[SRU][J][PATCH 0/1] CVE-2024-54683

[Cengiz Can]

https://ubuntu.com/security/CVE-2024-54683

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

netfilter: IDLETIMER: Fix for possible ABBA deadlock

Deletion of the last rule referencing a given idletimer may happen at the same
time as a read of its file in sysfs:

| ======================================================
| WARNING: possible circular locking dependency detected
| 6.12.0-rc7-01692-g5e9a28f41134-dirty #594 Not tainted
| ------------------------------------------------------
| iptables/3303 is trying to acquire lock:
| ffff8881057e04b8 (kn->active#48){++++}-{0:0}, at: __kernfs_remove+0x20
|
| but task is already holding lock:
| ffffffffa0249068 (list_mutex){+.+.}-{3:3}, at: idletimer_tg_destroy_v]
|
| which lock already depends on the new lock.

A simple reproducer is:

| #!/bin/bash
|
| while true; do
|         iptables -A INPUT -i foo -j IDLETIMER --timeout 10 --label "testme"
|         iptables -D INPUT -i foo -j IDLETIMER --timeout 10 --label "testme"
| done &
| while true; do
|         cat /sys/class/xt_idletimer/timers/testme >/dev/null
| done

Avoid this by freeing list_mutex right after deleting the element from the
list, then continuing with the teardown.

[ Fix ]

jammy/linux: backported from f36b01994d68

The backport keeps this tree's del_timer_sync() rather than upstream's
timer_shutdown_sync() in both destroy functions, since timer_shutdown_sync()
does not exist in this older tree. Functionally the change moves the
list_mutex unlock to immediately after the element is removed from the list,
so the remaining teardown (including sysfs removal) no longer runs while
list_mutex is held, breaking the lock cycle.

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

A bad fix would affect systems that use the netfilter xt_IDLETIMER target,
typically iptables/ip6tables rules employing "-j IDLETIMER" together with the
sysfs timer files under /sys/class/xt_idletimer/timers/; regressions could
manifest as timer teardown races, use-after-free, or stale sysfs entries when
rules are rapidly added and deleted. Systems that do not load the
xt_IDLETIMER module or do not use IDLETIMER rules are not affected.

[ Other Info ]

Kybele flow-v11-22-gf3c7ff80. Reference: c437e6d4/v1