IDLETIMER keeps its timer registry, reference counts, and sysfs files in module-global state, while Xtables invokes checkentry and destroy for rules in individual network namespaces. A matching label from another namespace can therefore reuse and control an existing timer. The sysfs interface is global and cannot represent per-namespace labels with the current target design. Reject IDLETIMER rules outside init_net so that global state stays in the namespace it was built for. Fixes: 0902b469bd25 ("netfilter: xtables: idletimer target implementation") Cc: stable@vger.kernel.org Reported-by: Vega Signed-off-by: Zhiling Zou --- net/netfilter/xt_IDLETIMER.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c index fe7d8d19629b4..155d6cc61dfde 100644 --- a/net/netfilter/xt_IDLETIMER.c +++ b/net/netfilter/xt_IDLETIMER.c @@ -28,6 +28,7 @@ #include #include #include +#include struct idletimer_tg { struct list_head entry; @@ -308,6 +309,9 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param *par) struct idletimer_tg_info *info = par->targinfo; int ret; + if (!net_eq(par->net, &init_net)) + return -EOPNOTSUPP; + ret = idletimer_tg_helper(info); if(ret < 0) return -EINVAL; @@ -341,6 +345,9 @@ static int idletimer_tg_checkentry_v1(const struct xt_tgchk_param *par) struct idletimer_tg_info_v1 *info = par->targinfo; int ret; + if (!net_eq(par->net, &init_net)) + return -EOPNOTSUPP; + if (info->send_nl_msg) return -EOPNOTSUPP; -- 2.43.0