This is a note to let you know that I've just added the patch titled

netfilter: xt_hashlimit: fix lock imbalance

to the 4.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git%3Ba=su...

The filename of the patch is: netfilter-xt_hashlimit-fix-lock-imbalance.patch and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let stable@vger.kernel.org know about it.

From de526f401284e1638d4c97cb5a4c292ac3f37655 Mon Sep 17 00:00:00 2001

From: Eric Dumazet edumazet@google.com Date: Mon, 12 Feb 2018 08:11:48 -0800 Subject: netfilter: xt_hashlimit: fix lock imbalance

From: Eric Dumazet edumazet@google.com

commit de526f401284e1638d4c97cb5a4c292ac3f37655 upstream.

syszkaller found that rcu was not held in hashlimit_mt_common()

We only need to enable BH at this point.

Fixes: bea74641e378 ("netfilter: xt_hashlimit: add rate match mode") Signed-off-by: Eric Dumazet edumazet@google.com Reported-by: syzkaller syzkaller@googlegroups.com Signed-off-by: Pablo Neira Ayuso pablo@netfilter.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org

--- net/netfilter/xt_hashlimit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/netfilter/xt_hashlimit.c +++ b/net/netfilter/xt_hashlimit.c @@ -774,7 +774,7 @@ hashlimit_mt_common(const struct sk_buff if (!dh->rateinfo.prev_window && (dh->rateinfo.current_rate <= dh->rateinfo.burst)) { spin_unlock(&dh->lock); - rcu_read_unlock_bh(); + local_bh_enable(); return !(cfg->mode & XT_HASHLIMIT_INVERT); } else { goto overlimit;

Patches currently in stable-queue which might be from edumazet@google.com are

queue-4.14/netfilter-xt_hashlimit-fix-lock-imbalance.patch queue-4.14/netfilter-use-skb_to_full_sk-in-ip6_route_me_harder.patch queue-4.14/netfilter-idletimer-be-syzkaller-friendly.patch