nft: keep original cache in case of ERESTART

Phil Sutter says:

"The problem is that data in h->obj_list potentially sits in cache, too.
At least rules have to be there so insert with index works correctly. If
the cache is flushed before regenerating the batch, use-after-free
occurs which crashes the program."

This patch keeps around the original cache until we have refreshed the
batch.

Fixes: 862818ac3a0de ("xtables: add and use nft_build_cache")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/iptables/nft.c b/iptables/nft.c
index 172beec9ae27587a8204a96c305cd4b5b7aad885..288ada4af3ca139cda4f49d774a272da930bac40 100644 (file)
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -811,7 +811,7 @@ int nft_init(struct nft_handle *h, const struct builtin_table *t)
 
        h->portid = mnl_socket_get_portid(h->nl);
        h->tables = t;
-       h->cache = &h->__cache;
+       h->cache = &h->__cache[0];
 
        INIT_LIST_HEAD(&h->obj_list);
        INIT_LIST_HEAD(&h->err_list);
@@ -1618,14 +1618,30 @@ void nft_build_cache(struct nft_handle *h)
                __nft_build_cache(h);
 }
 
-static void nft_rebuild_cache(struct nft_handle *h)
+static void __nft_flush_cache(struct nft_handle *h)
 {
-       if (!h->have_cache)
+       if (!h->cache_index) {
+               h->cache_index++;
+               h->cache = &h->__cache[h->cache_index];
+       } else {
                flush_chain_cache(h, NULL);
+       }
+}
+
+static void nft_rebuild_cache(struct nft_handle *h)
+{
+       if (h->have_cache)
+               __nft_flush_cache(h);
 
        __nft_build_cache(h);
 }
 
+static void nft_release_cache(struct nft_handle *h)
+{
+       if (h->cache_index)
+               flush_cache(&h->__cache[0], h->tables, NULL);
+}
+
 struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
                                            const char *table)
 {
@@ -2957,6 +2973,7 @@ retry:
                batch_obj_del(h, n);
        }
 
+       nft_release_cache(h);
        mnl_batch_reset(h->batch);
 
        if (i)

diff --git a/iptables/nft.h b/iptables/nft.h
index dc0797d302b869d1bebf48d78fa2d45f097249e1..43eb8a39dd9c1d5db1cdde344b1717135dc23743 100644 (file)
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -48,7 +48,8 @@ struct nft_handle {
        struct list_head        err_list;
        struct nft_family_ops   *ops;
        const struct builtin_table *tables;
-       struct nft_cache        __cache;
+       unsigned int            cache_index;
+       struct nft_cache        __cache[2];
        struct nft_cache        *cache;
        bool                    have_cache;
        bool                    restore;