From: Greg Kroah-Hartman Date: Sun, 28 May 2023 07:36:13 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: review~57 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b0c835c78b21564d7a5b7f7755d2be16d9bb220b;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: netfilter-nf_tables-add-nft_setelem_parse_key.patch netfilter-nf_tables-allow-up-to-64-bytes-in-the-set-element-data-area.patch netfilter-nf_tables-do-not-allow-rule_id-to-refer-to-another-chain.patch netfilter-nf_tables-do-not-allow-set_id-to-refer-to-another-table.patch netfilter-nf_tables-fix-register-ordering.patch netfilter-nf_tables-stricter-validation-of-element-data.patch netfilter-nf_tables-validate-registers-coming-from-userspace.patch netfilter-nft_dynset-do-not-reject-set-updates-with-nft_set_eval.patch netfilter-nftables-add-nft_parse_register_load-and-use-it.patch netfilter-nftables-add-nft_parse_register_store-and-use-it.patch netfilter-nftables-statify-nft_parse_register.patch --- diff --git a/queue-4.14/netfilter-nf_tables-add-nft_setelem_parse_key.patch b/queue-4.14/netfilter-nf_tables-add-nft_setelem_parse_key.patch new file mode 100644 index 00000000000..fc7cc0c9975 --- /dev/null +++ b/queue-4.14/netfilter-nf_tables-add-nft_setelem_parse_key.patch @@ -0,0 +1,216 @@ +From stable-owner@vger.kernel.org Sat May 27 16:08:12 2023 +From: Pablo Neira Ayuso +Date: Sat, 27 May 2023 18:08:05 +0200 +Subject: netfilter: nf_tables: add nft_setelem_parse_key() +To: netfilter-devel@vger.kernel.org +Cc: gregkh@linuxfoundation.org, stable@vger.kernel.org, sashal@kernel.org +Message-ID: <20230527160811.67779-6-pablo@netfilter.org> + +From: Pablo Neira Ayuso + +[ 20a1452c35425b2cef76f21f8395ef069dfddfa9 ] + +Add helper function to parse the set element key netlink attribute. + +v4: No changes +v3: New patch + +[sbrivio: refactor error paths and labels; use NFT_DATA_VALUE_MAXLEN + instead of sizeof(*key) in helper, value can be longer than that; + rebase] +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 78 ++++++++++++++++++++++-------------------- + 1 file changed, 42 insertions(+), 36 deletions(-) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -3736,6 +3736,24 @@ static int nf_tables_dump_set_done(struc + return 0; + } + ++static int nft_setelem_parse_key(struct nft_ctx *ctx, struct nft_set *set, ++ struct nft_data *key, struct nlattr *attr) ++{ ++ struct nft_data_desc desc; ++ int err; ++ ++ err = nft_data_init(ctx, key, NFT_DATA_VALUE_MAXLEN, &desc, attr); ++ if (err < 0) ++ return err; ++ ++ if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) { ++ nft_data_release(key, desc.type); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + static int nf_tables_getsetelem(struct net *net, struct sock *nlsk, + struct sk_buff *skb, const struct nlmsghdr *nlh, + const struct nlattr * const nla[], +@@ -3941,13 +3959,13 @@ static int nft_add_set_elem(struct nft_c + { + struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; + u8 genmask = nft_genmask_next(ctx->net); +- struct nft_data_desc d1, d2; + struct nft_set_ext_tmpl tmpl; + struct nft_set_ext *ext, *ext2; + struct nft_set_elem elem; + struct nft_set_binding *binding; + struct nft_object *obj = NULL; + struct nft_userdata *udata; ++ struct nft_data_desc desc; + struct nft_data data; + enum nft_registers dreg; + struct nft_trans *trans; +@@ -4000,15 +4018,12 @@ static int nft_add_set_elem(struct nft_c + timeout = set->timeout; + } + +- err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &d1, +- nla[NFTA_SET_ELEM_KEY]); ++ err = nft_setelem_parse_key(ctx, set, &elem.key.val, ++ nla[NFTA_SET_ELEM_KEY]); + if (err < 0) + goto err1; +- err = -EINVAL; +- if (d1.type != NFT_DATA_VALUE || d1.len != set->klen) +- goto err2; + +- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, d1.len); ++ nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); + if (timeout > 0) { + nft_set_ext_add(&tmpl, NFT_SET_EXT_EXPIRATION); + if (timeout != set->timeout) +@@ -4030,13 +4045,13 @@ static int nft_add_set_elem(struct nft_c + } + + if (nla[NFTA_SET_ELEM_DATA] != NULL) { +- err = nft_data_init(ctx, &data, sizeof(data), &d2, ++ err = nft_data_init(ctx, &data, sizeof(data), &desc, + nla[NFTA_SET_ELEM_DATA]); + if (err < 0) + goto err2; + + err = -EINVAL; +- if (set->dtype != NFT_DATA_VERDICT && d2.len != set->dlen) ++ if (set->dtype != NFT_DATA_VERDICT && desc.len != set->dlen) + goto err3; + + dreg = nft_type_to_reg(set->dtype); +@@ -4053,12 +4068,12 @@ static int nft_add_set_elem(struct nft_c + + err = nft_validate_register_store(&bind_ctx, dreg, + &data, +- d2.type, d2.len); ++ desc.type, desc.len); + if (err < 0) + goto err3; + } + +- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, d2.len); ++ nft_set_ext_add_length(&tmpl, NFT_SET_EXT_DATA, desc.len); + } + + /* The full maximum length of userdata can exceed the maximum +@@ -4141,9 +4156,9 @@ err4: + kfree(elem.priv); + err3: + if (nla[NFTA_SET_ELEM_DATA] != NULL) +- nft_data_release(&data, d2.type); ++ nft_data_release(&data, desc.type); + err2: +- nft_data_release(&elem.key.val, d1.type); ++ nft_data_release(&elem.key.val, NFT_DATA_VALUE); + err1: + return err; + } +@@ -4241,7 +4256,6 @@ static int nft_del_setelem(struct nft_ct + { + struct nlattr *nla[NFTA_SET_ELEM_MAX + 1]; + struct nft_set_ext_tmpl tmpl; +- struct nft_data_desc desc; + struct nft_set_elem elem; + struct nft_set_ext *ext; + struct nft_trans *trans; +@@ -4252,11 +4266,10 @@ static int nft_del_setelem(struct nft_ct + err = nla_parse_nested(nla, NFTA_SET_ELEM_MAX, attr, + nft_set_elem_policy, NULL); + if (err < 0) +- goto err1; ++ return err; + +- err = -EINVAL; + if (nla[NFTA_SET_ELEM_KEY] == NULL) +- goto err1; ++ return -EINVAL; + + nft_set_ext_prepare(&tmpl); + +@@ -4266,37 +4279,31 @@ static int nft_del_setelem(struct nft_ct + if (flags != 0) + nft_set_ext_add(&tmpl, NFT_SET_EXT_FLAGS); + +- err = nft_data_init(ctx, &elem.key.val, sizeof(elem.key), &desc, +- nla[NFTA_SET_ELEM_KEY]); ++ err = nft_setelem_parse_key(ctx, set, &elem.key.val, ++ nla[NFTA_SET_ELEM_KEY]); + if (err < 0) +- goto err1; +- +- err = -EINVAL; +- if (desc.type != NFT_DATA_VALUE || desc.len != set->klen) +- goto err2; ++ return err; + +- nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, desc.len); ++ nft_set_ext_add_length(&tmpl, NFT_SET_EXT_KEY, set->klen); + + err = -ENOMEM; + elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, NULL, 0, + GFP_KERNEL); + if (elem.priv == NULL) +- goto err2; ++ goto fail_elem; + + ext = nft_set_elem_ext(set, elem.priv); + if (flags) + *nft_set_ext_flags(ext) = flags; + + trans = nft_trans_elem_alloc(ctx, NFT_MSG_DELSETELEM, set); +- if (trans == NULL) { +- err = -ENOMEM; +- goto err3; +- } ++ if (trans == NULL) ++ goto fail_trans; + + priv = set->ops->deactivate(ctx->net, set, &elem); + if (priv == NULL) { + err = -ENOENT; +- goto err4; ++ goto fail_ops; + } + kfree(elem.priv); + elem.priv = priv; +@@ -4307,13 +4314,12 @@ static int nft_del_setelem(struct nft_ct + list_add_tail(&trans->list, &ctx->net->nft.commit_list); + return 0; + +-err4: ++fail_ops: + kfree(trans); +-err3: ++fail_trans: + kfree(elem.priv); +-err2: +- nft_data_release(&elem.key.val, desc.type); +-err1: ++fail_elem: ++ nft_data_release(&elem.key.val, NFT_DATA_VALUE); + return err; + } + diff --git a/queue-4.14/netfilter-nf_tables-allow-up-to-64-bytes-in-the-set-element-data-area.patch b/queue-4.14/netfilter-nf_tables-allow-up-to-64-bytes-in-the-set-element-data-area.patch new file mode 100644 index 00000000000..324bb66ab3d --- /dev/null +++ b/queue-4.14/netfilter-nf_tables-allow-up-to-64-bytes-in-the-set-element-data-area.patch @@ -0,0 +1,116 @@ +From stable-owner@vger.kernel.org Sat May 27 16:08:14 2023 +From: Pablo Neira Ayuso +Date: Sat, 27 May 2023 18:08:06 +0200 +Subject: netfilter: nf_tables: allow up to 64 bytes in the set element data area +To: netfilter-devel@vger.kernel.org +Cc: gregkh@linuxfoundation.org, stable@vger.kernel.org, sashal@kernel.org +Message-ID: <20230527160811.67779-7-pablo@netfilter.org> + +From: Pablo Neira Ayuso + +[ fdb9c405e35bdc6e305b9b4e20ebc141ed14fc81 ] + +So far, the set elements could store up to 128-bits in the data area. + +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + include/net/netfilter/nf_tables.h | 4 ++++ + net/netfilter/nf_tables_api.c | 35 +++++++++++++++++++++++++---------- + 2 files changed, 29 insertions(+), 10 deletions(-) + +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -229,6 +229,10 @@ struct nft_set_elem { + u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)]; + struct nft_data val; + } key; ++ union { ++ u32 buf[NFT_DATA_VALUE_MAXLEN / sizeof(u32)]; ++ struct nft_data val; ++ } data; + void *priv; + }; + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -3954,6 +3954,25 @@ static int nft_setelem_parse_flags(const + return 0; + } + ++static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set, ++ struct nft_data_desc *desc, ++ struct nft_data *data, ++ struct nlattr *attr) ++{ ++ int err; ++ ++ err = nft_data_init(ctx, data, NFT_DATA_VALUE_MAXLEN, desc, attr); ++ if (err < 0) ++ return err; ++ ++ if (desc->type != NFT_DATA_VERDICT && desc->len != set->dlen) { ++ nft_data_release(data, desc->type); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + const struct nlattr *attr, u32 nlmsg_flags) + { +@@ -3966,7 +3985,6 @@ static int nft_add_set_elem(struct nft_c + struct nft_object *obj = NULL; + struct nft_userdata *udata; + struct nft_data_desc desc; +- struct nft_data data; + enum nft_registers dreg; + struct nft_trans *trans; + u32 flags = 0; +@@ -4045,15 +4063,11 @@ static int nft_add_set_elem(struct nft_c + } + + if (nla[NFTA_SET_ELEM_DATA] != NULL) { +- err = nft_data_init(ctx, &data, sizeof(data), &desc, +- nla[NFTA_SET_ELEM_DATA]); ++ err = nft_setelem_parse_data(ctx, set, &desc, &elem.data.val, ++ nla[NFTA_SET_ELEM_DATA]); + if (err < 0) + goto err2; + +- err = -EINVAL; +- if (set->dtype != NFT_DATA_VERDICT && desc.len != set->dlen) +- goto err3; +- + dreg = nft_type_to_reg(set->dtype); + list_for_each_entry(binding, &set->bindings, list) { + struct nft_ctx bind_ctx = { +@@ -4067,7 +4081,7 @@ static int nft_add_set_elem(struct nft_c + continue; + + err = nft_validate_register_store(&bind_ctx, dreg, +- &data, ++ &elem.data.val, + desc.type, desc.len); + if (err < 0) + goto err3; +@@ -4089,7 +4103,8 @@ static int nft_add_set_elem(struct nft_c + } + + err = -ENOMEM; +- elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, data.data, ++ elem.priv = nft_set_elem_init(set, &tmpl, elem.key.val.data, ++ elem.data.val.data, + timeout, GFP_KERNEL); + if (elem.priv == NULL) + goto err3; +@@ -4156,7 +4171,7 @@ err4: + kfree(elem.priv); + err3: + if (nla[NFTA_SET_ELEM_DATA] != NULL) +- nft_data_release(&data, desc.type); ++ nft_data_release(&elem.data.val, desc.type); + err2: + nft_data_release(&elem.key.val, NFT_DATA_VALUE); + err1: diff --git a/queue-4.14/netfilter-nf_tables-do-not-allow-rule_id-to-refer-to-another-chain.patch b/queue-4.14/netfilter-nf_tables-do-not-allow-rule_id-to-refer-to-another-chain.patch new file mode 100644 index 00000000000..451d558c72e --- /dev/null +++ b/queue-4.14/netfilter-nf_tables-do-not-allow-rule_id-to-refer-to-another-chain.patch @@ -0,0 +1,59 @@ +From stable-owner@vger.kernel.org Sat May 27 16:08:15 2023 +From: Pablo Neira Ayuso +Date: Sat, 27 May 2023 18:08:09 +0200 +Subject: netfilter: nf_tables: do not allow RULE_ID to refer to another chain +To: netfilter-devel@vger.kernel.org +Cc: gregkh@linuxfoundation.org, stable@vger.kernel.org, sashal@kernel.org +Message-ID: <20230527160811.67779-10-pablo@netfilter.org> + +From: Pablo Neira Ayuso + +[ 36d5b2913219ac853908b0f1c664345e04313856 ] + +When doing lookups for rules on the same batch by using its ID, a rule from +a different chain can be used. If a rule is added to a chain but tries to +be positioned next to a rule from a different chain, it will be linked to +chain2, but the use counter on chain1 would be the one to be incremented. + +When looking for rules by ID, use the chain that was used for the lookup by +name. The chain used in the context copied to the transaction needs to +match that same chain. That way, struct nft_rule does not need to get +enlarged with another member. + +Fixes: 1a94e38d254b ("netfilter: nf_tables: add NFTA_RULE_ID attribute") +Fixes: 75dd48e2e420 ("netfilter: nf_tables: Support RULE_ID reference in new rule") +Signed-off-by: Thadeu Lima de Souza Cascardo +Cc: +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2475,6 +2475,7 @@ err1: + } + + static struct nft_rule *nft_rule_lookup_byid(const struct net *net, ++ const struct nft_chain *chain, + const struct nlattr *nla) + { + u32 id = ntohl(nla_get_be32(nla)); +@@ -2484,6 +2485,7 @@ static struct nft_rule *nft_rule_lookup_ + struct nft_rule *rule = nft_trans_rule(trans); + + if (trans->msg_type == NFT_MSG_NEWRULE && ++ trans->ctx.chain == chain && + id == nft_trans_rule_id(trans)) + return rule; + } +@@ -2530,7 +2532,7 @@ static int nf_tables_delrule(struct net + + err = nft_delrule(&ctx, rule); + } else if (nla[NFTA_RULE_ID]) { +- rule = nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]); ++ rule = nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_ID]); + if (IS_ERR(rule)) + return PTR_ERR(rule); + diff --git a/queue-4.14/netfilter-nf_tables-do-not-allow-set_id-to-refer-to-another-table.patch b/queue-4.14/netfilter-nf_tables-do-not-allow-set_id-to-refer-to-another-table.patch new file mode 100644 index 00000000000..a804cd7fcaf --- /dev/null +++ b/queue-4.14/netfilter-nf_tables-do-not-allow-set_id-to-refer-to-another-table.patch @@ -0,0 +1,96 @@ +From stable-owner@vger.kernel.org Sat May 27 16:08:15 2023 +From: Pablo Neira Ayuso +Date: Sat, 27 May 2023 18:08:10 +0200 +Subject: netfilter: nf_tables: do not allow SET_ID to refer to another table +To: netfilter-devel@vger.kernel.org +Cc: gregkh@linuxfoundation.org, stable@vger.kernel.org, sashal@kernel.org +Message-ID: <20230527160811.67779-11-pablo@netfilter.org> + +From: Pablo Neira Ayuso + +[ 470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2 ] + +When doing lookups for sets on the same batch by using its ID, a set from a +different table can be used. + +Then, when the table is removed, a reference to the set may be kept after +the set is freed, leading to a potential use-after-free. + +When looking for sets by ID, use the table that was used for the lookup by +name, and only return sets belonging to that same table. + +This fixes CVE-2022-2586, also reported as ZDI-CAN-17470. + +Reported-by: Team Orca of Sea Security (@seasecresponse) +Fixes: 958bee14d071 ("netfilter: nf_tables: use new transaction infrastructure to handle sets") +Signed-off-by: Thadeu Lima de Souza Cascardo +Cc: +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + include/net/netfilter/nf_tables.h | 2 ++ + net/netfilter/nf_tables_api.c | 7 +++++-- + 2 files changed, 7 insertions(+), 2 deletions(-) + +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -381,6 +381,7 @@ void nft_unregister_set(struct nft_set_t + * + * @list: table set list node + * @bindings: list of set bindings ++ * @table: table this set belongs to + * @name: name of the set + * @ktype: key type (numeric type defined by userspace, not used in the kernel) + * @dtype: data type (verdict or numeric type defined by userspace) +@@ -404,6 +405,7 @@ void nft_unregister_set(struct nft_set_t + struct nft_set { + struct list_head list; + struct list_head bindings; ++ struct nft_table *table; + char *name; + u32 ktype; + u32 dtype; +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2746,6 +2746,7 @@ static struct nft_set *nf_tables_set_loo + } + + static struct nft_set *nf_tables_set_lookup_byid(const struct net *net, ++ const struct nft_table *table, + const struct nlattr *nla, + u8 genmask) + { +@@ -2757,6 +2758,7 @@ static struct nft_set *nf_tables_set_loo + struct nft_set *set = nft_trans_set(trans); + + if (id == nft_trans_set_id(trans) && ++ set->table == table && + nft_active_genmask(set, genmask)) + return set; + } +@@ -2777,7 +2779,7 @@ struct nft_set *nft_set_lookup(const str + if (!nla_set_id) + return set; + +- set = nf_tables_set_lookup_byid(net, nla_set_id, genmask); ++ set = nf_tables_set_lookup_byid(net, table, nla_set_id, genmask); + } + return set; + } +@@ -3272,6 +3274,7 @@ static int nf_tables_newset(struct net * + } + + INIT_LIST_HEAD(&set->bindings); ++ set->table = table; + set->ops = ops; + set->ktype = ktype; + set->klen = desc.klen; +@@ -4209,7 +4212,7 @@ static int nf_tables_newsetelem(struct n + genmask); + if (IS_ERR(set)) { + if (nla[NFTA_SET_ELEM_LIST_SET_ID]) { +- set = nf_tables_set_lookup_byid(net, ++ set = nf_tables_set_lookup_byid(net, ctx.table, + nla[NFTA_SET_ELEM_LIST_SET_ID], + genmask); + } diff --git a/queue-4.14/netfilter-nf_tables-fix-register-ordering.patch b/queue-4.14/netfilter-nf_tables-fix-register-ordering.patch new file mode 100644 index 00000000000..c2d59b2375c --- /dev/null +++ b/queue-4.14/netfilter-nf_tables-fix-register-ordering.patch @@ -0,0 +1,63 @@ +From stable-owner@vger.kernel.org Sat May 27 16:08:14 2023 +From: Pablo Neira Ayuso +Date: Sat, 27 May 2023 18:08:11 +0200 +Subject: netfilter: nf_tables: fix register ordering +To: netfilter-devel@vger.kernel.org +Cc: gregkh@linuxfoundation.org, stable@vger.kernel.org, sashal@kernel.org +Message-ID: <20230527160811.67779-12-pablo@netfilter.org> + +From: Florian Westphal + +[ d209df3e7f7002d9099fdb0f6df0f972b4386a63 ] + +[ We hit the trace described in commit message with the +kselftest/nft_trans_stress.sh. This patch diverges from the upstream one +since kernel 4.14 does not have following symbols: +nft_chain_filter_init, nf_tables_flowtable_notifier ] + +We must register nfnetlink ops last, as that exposes nf_tables to +userspace. Without this, we could theoretically get nfnetlink request +before net->nft state has been initialized. + +Fixes: 99633ab29b213 ("netfilter: nf_tables: complete net namespace support") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +[apanyaki: backport to v4.14-stable] +Signed-off-by: Andrew Paniakin +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -6105,18 +6105,25 @@ static int __init nf_tables_module_init( + goto err1; + } + +- err = nf_tables_core_module_init(); ++ err = register_pernet_subsys(&nf_tables_net_ops); + if (err < 0) + goto err2; + +- err = nfnetlink_subsys_register(&nf_tables_subsys); ++ err = nf_tables_core_module_init(); + if (err < 0) + goto err3; + ++ /* must be last */ ++ err = nfnetlink_subsys_register(&nf_tables_subsys); ++ if (err < 0) ++ goto err4; ++ + pr_info("nf_tables: (c) 2007-2009 Patrick McHardy \n"); +- return register_pernet_subsys(&nf_tables_net_ops); +-err3: ++ return err; ++err4: + nf_tables_core_module_exit(); ++err3: ++ unregister_pernet_subsys(&nf_tables_net_ops); + err2: + kfree(info); + err1: diff --git a/queue-4.14/netfilter-nf_tables-stricter-validation-of-element-data.patch b/queue-4.14/netfilter-nf_tables-stricter-validation-of-element-data.patch new file mode 100644 index 00000000000..9d824b7ab64 --- /dev/null +++ b/queue-4.14/netfilter-nf_tables-stricter-validation-of-element-data.patch @@ -0,0 +1,47 @@ +From stable-owner@vger.kernel.org Sat May 27 16:08:14 2023 +From: Pablo Neira Ayuso +Date: Sat, 27 May 2023 18:08:07 +0200 +Subject: netfilter: nf_tables: stricter validation of element data +To: netfilter-devel@vger.kernel.org +Cc: gregkh@linuxfoundation.org, stable@vger.kernel.org, sashal@kernel.org +Message-ID: <20230527160811.67779-8-pablo@netfilter.org> + +From: Pablo Neira Ayuso + +[ 7e6bc1f6cabcd30aba0b11219d8e01b952eacbb6 ] + +Make sure element data type and length do not mismatch the one specified +by the set declaration. + +Fixes: 7d7402642eaf ("netfilter: nf_tables: variable sized set element keys / data") +Reported-by: Hugues ANGUELKOV +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -3959,13 +3959,20 @@ static int nft_setelem_parse_data(struct + struct nft_data *data, + struct nlattr *attr) + { ++ u32 dtype; + int err; + + err = nft_data_init(ctx, data, NFT_DATA_VALUE_MAXLEN, desc, attr); + if (err < 0) + return err; + +- if (desc->type != NFT_DATA_VERDICT && desc->len != set->dlen) { ++ if (set->dtype == NFT_DATA_VERDICT) ++ dtype = NFT_DATA_VERDICT; ++ else ++ dtype = NFT_DATA_VALUE; ++ ++ if (dtype != desc->type || ++ set->dlen != desc->len) { + nft_data_release(data, desc->type); + return -EINVAL; + } diff --git a/queue-4.14/netfilter-nf_tables-validate-registers-coming-from-userspace.patch b/queue-4.14/netfilter-nf_tables-validate-registers-coming-from-userspace.patch new file mode 100644 index 00000000000..a0d4838960d --- /dev/null +++ b/queue-4.14/netfilter-nf_tables-validate-registers-coming-from-userspace.patch @@ -0,0 +1,83 @@ +From stable-owner@vger.kernel.org Sat May 27 16:08:12 2023 +From: Pablo Neira Ayuso +Date: Sat, 27 May 2023 18:08:04 +0200 +Subject: netfilter: nf_tables: validate registers coming from userspace. +To: netfilter-devel@vger.kernel.org +Cc: gregkh@linuxfoundation.org, stable@vger.kernel.org, sashal@kernel.org +Message-ID: <20230527160811.67779-5-pablo@netfilter.org> + +From: Pablo Neira Ayuso + +[ 6e1acfa387b9ff82cfc7db8cc3b6959221a95851 ] + +Bail out in case userspace uses unsupported registers. + +Fixes: 49499c3e6e18 ("netfilter: nf_tables: switch registers to 32 bit addressing") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 31 +++++++++++++++++-------------- + 1 file changed, 17 insertions(+), 14 deletions(-) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5615,26 +5615,23 @@ int nft_parse_u32_check(const struct nla + } + EXPORT_SYMBOL_GPL(nft_parse_u32_check); + +-/** +- * nft_parse_register - parse a register value from a netlink attribute +- * +- * @attr: netlink attribute +- * +- * Parse and translate a register value from a netlink attribute. +- * Registers used to be 128 bit wide, these register numbers will be +- * mapped to the corresponding 32 bit register numbers. +- */ +-static unsigned int nft_parse_register(const struct nlattr *attr) ++static int nft_parse_register(const struct nlattr *attr, u32 *preg) + { + unsigned int reg; + + reg = ntohl(nla_get_be32(attr)); + switch (reg) { + case NFT_REG_VERDICT...NFT_REG_4: +- return reg * NFT_REG_SIZE / NFT_REG32_SIZE; ++ *preg = reg * NFT_REG_SIZE / NFT_REG32_SIZE; ++ break; ++ case NFT_REG32_00...NFT_REG32_15: ++ *preg = reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00; ++ break; + default: +- return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00; ++ return -ERANGE; + } ++ ++ return 0; + } + + /** +@@ -5685,7 +5682,10 @@ int nft_parse_register_load(const struct + u32 reg; + int err; + +- reg = nft_parse_register(attr); ++ err = nft_parse_register(attr, ®); ++ if (err < 0) ++ return err; ++ + err = nft_validate_register_load(reg, len); + if (err < 0) + return err; +@@ -5761,7 +5761,10 @@ int nft_parse_register_store(const struc + int err; + u32 reg; + +- reg = nft_parse_register(attr); ++ err = nft_parse_register(attr, ®); ++ if (err < 0) ++ return err; ++ + err = nft_validate_register_store(ctx, reg, data, type, len); + if (err < 0) + return err; diff --git a/queue-4.14/netfilter-nft_dynset-do-not-reject-set-updates-with-nft_set_eval.patch b/queue-4.14/netfilter-nft_dynset-do-not-reject-set-updates-with-nft_set_eval.patch new file mode 100644 index 00000000000..91a2c078147 --- /dev/null +++ b/queue-4.14/netfilter-nft_dynset-do-not-reject-set-updates-with-nft_set_eval.patch @@ -0,0 +1,49 @@ +From stable-owner@vger.kernel.org Sat May 27 16:08:12 2023 +From: Pablo Neira Ayuso +Date: Sat, 27 May 2023 18:08:08 +0200 +Subject: netfilter: nft_dynset: do not reject set updates with NFT_SET_EVAL +To: netfilter-devel@vger.kernel.org +Cc: gregkh@linuxfoundation.org, stable@vger.kernel.org, sashal@kernel.org +Message-ID: <20230527160811.67779-9-pablo@netfilter.org> + +From: Pablo Neira Ayuso + +[ 215a31f19dedd4e92a67cf5a9717ee898d012b3a ] + +NFT_SET_EVAL is signalling the kernel that this sets can be updated from +the evaluation path, even if there are no expressions attached to the +element. Otherwise, set updates with no expressions fail. Update +description to describe the right semantics. + +Fixes: 22fe54d5fefc ("netfilter: nf_tables: add support for dynamic set updates") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + include/uapi/linux/netfilter/nf_tables.h | 2 +- + net/netfilter/nft_dynset.c | 4 +--- + 2 files changed, 2 insertions(+), 4 deletions(-) + +--- a/include/uapi/linux/netfilter/nf_tables.h ++++ b/include/uapi/linux/netfilter/nf_tables.h +@@ -258,7 +258,7 @@ enum nft_rule_compat_attributes { + * @NFT_SET_INTERVAL: set contains intervals + * @NFT_SET_MAP: set is used as a dictionary + * @NFT_SET_TIMEOUT: set uses timeouts +- * @NFT_SET_EVAL: set contains expressions for evaluation ++ * @NFT_SET_EVAL: set can be updated from the evaluation path + * @NFT_SET_OBJECT: set contains stateful objects + */ + enum nft_set_flags { +--- a/net/netfilter/nft_dynset.c ++++ b/net/netfilter/nft_dynset.c +@@ -190,9 +190,7 @@ static int nft_dynset_init(const struct + priv->expr = nft_expr_init(ctx, tb[NFTA_DYNSET_EXPR]); + if (IS_ERR(priv->expr)) + return PTR_ERR(priv->expr); +- +- } else if (set->flags & NFT_SET_EVAL) +- return -EINVAL; ++ } + + nft_set_ext_prepare(&priv->tmpl); + nft_set_ext_add_length(&priv->tmpl, NFT_SET_EXT_KEY, set->klen); diff --git a/queue-4.14/netfilter-nftables-add-nft_parse_register_load-and-use-it.patch b/queue-4.14/netfilter-nftables-add-nft_parse_register_load-and-use-it.patch new file mode 100644 index 00000000000..2170119d87a --- /dev/null +++ b/queue-4.14/netfilter-nftables-add-nft_parse_register_load-and-use-it.patch @@ -0,0 +1,735 @@ +From stable-owner@vger.kernel.org Sat May 27 16:08:12 2023 +From: Pablo Neira Ayuso +Date: Sat, 27 May 2023 18:08:01 +0200 +Subject: netfilter: nftables: add nft_parse_register_load() and use it +To: netfilter-devel@vger.kernel.org +Cc: gregkh@linuxfoundation.org, stable@vger.kernel.org, sashal@kernel.org +Message-ID: <20230527160811.67779-2-pablo@netfilter.org> + +From: Pablo Neira Ayuso + +[ backport of 4f16d25c68ec844299a4df6ecbb0234eaf88a935 ] + +This new function combines the netlink register attribute parser +and the load validation function. + +This update requires to replace: + + enum nft_registers sreg:8; + +in many of the expression private areas otherwise compiler complains +with: + + error: cannot take address of bit-field ‘sreg’ + +when passing the register field as reference. + +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + include/net/netfilter/nf_tables.h | 2 - + include/net/netfilter/nf_tables_core.h | 12 +++++++++-- + include/net/netfilter/nft_masq.h | 4 +-- + include/net/netfilter/nft_meta.h | 2 - + include/net/netfilter/nft_redir.h | 4 +-- + net/ipv4/netfilter/nft_dup_ipv4.c | 18 ++++++++-------- + net/ipv6/netfilter/nft_dup_ipv6.c | 18 ++++++++-------- + net/netfilter/nf_tables_api.c | 18 +++++++++++++++- + net/netfilter/nft_bitwise.c | 6 ++--- + net/netfilter/nft_byteorder.c | 6 ++--- + net/netfilter/nft_cmp.c | 8 ++----- + net/netfilter/nft_ct.c | 5 +--- + net/netfilter/nft_dup_netdev.c | 6 ++--- + net/netfilter/nft_dynset.c | 12 +++++------ + net/netfilter/nft_exthdr.c | 6 ++--- + net/netfilter/nft_fwd_netdev.c | 6 ++--- + net/netfilter/nft_hash.c | 10 +++++---- + net/netfilter/nft_lookup.c | 6 ++--- + net/netfilter/nft_masq.c | 14 ++++--------- + net/netfilter/nft_meta.c | 3 -- + net/netfilter/nft_nat.c | 35 +++++++++++++-------------------- + net/netfilter/nft_objref.c | 6 ++--- + net/netfilter/nft_payload.c | 4 +-- + net/netfilter/nft_queue.c | 12 +++++------ + net/netfilter/nft_range.c | 6 ++--- + net/netfilter/nft_redir.c | 14 ++++--------- + 26 files changed, 124 insertions(+), 119 deletions(-) + +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -198,7 +198,7 @@ int nft_parse_u32_check(const struct nla + unsigned int nft_parse_register(const struct nlattr *attr); + int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg); + +-int nft_validate_register_load(enum nft_registers reg, unsigned int len); ++int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len); + int nft_validate_register_store(const struct nft_ctx *ctx, + enum nft_registers reg, + const struct nft_data *data, +--- a/include/net/netfilter/nf_tables_core.h ++++ b/include/net/netfilter/nf_tables_core.h +@@ -14,9 +14,17 @@ extern struct nft_expr_type nft_range_ty + int nf_tables_core_module_init(void); + void nf_tables_core_module_exit(void); + ++struct nft_bitwise_fast_expr { ++ u32 mask; ++ u32 xor; ++ u8 sreg; ++ enum nft_registers dreg:8; ++}; ++ + struct nft_cmp_fast_expr { + u32 data; +- enum nft_registers sreg:8; ++ u32 mask; ++ u8 sreg; + u8 len; + }; + +@@ -43,7 +51,7 @@ struct nft_payload_set { + enum nft_payload_bases base:8; + u8 offset; + u8 len; +- enum nft_registers sreg:8; ++ u8 sreg; + u8 csum_type; + u8 csum_offset; + u8 csum_flags; +--- a/include/net/netfilter/nft_masq.h ++++ b/include/net/netfilter/nft_masq.h +@@ -4,8 +4,8 @@ + + struct nft_masq { + u32 flags; +- enum nft_registers sreg_proto_min:8; +- enum nft_registers sreg_proto_max:8; ++ u8 sreg_proto_min; ++ u8 sreg_proto_max; + }; + + extern const struct nla_policy nft_masq_policy[]; +--- a/include/net/netfilter/nft_meta.h ++++ b/include/net/netfilter/nft_meta.h +@@ -6,7 +6,7 @@ struct nft_meta { + enum nft_meta_keys key:8; + union { + enum nft_registers dreg:8; +- enum nft_registers sreg:8; ++ u8 sreg; + }; + }; + +--- a/include/net/netfilter/nft_redir.h ++++ b/include/net/netfilter/nft_redir.h +@@ -3,8 +3,8 @@ + #define _NFT_REDIR_H_ + + struct nft_redir { +- enum nft_registers sreg_proto_min:8; +- enum nft_registers sreg_proto_max:8; ++ u8 sreg_proto_min; ++ u8 sreg_proto_max; + u16 flags; + }; + +--- a/net/ipv4/netfilter/nft_dup_ipv4.c ++++ b/net/ipv4/netfilter/nft_dup_ipv4.c +@@ -16,8 +16,8 @@ + #include + + struct nft_dup_ipv4 { +- enum nft_registers sreg_addr:8; +- enum nft_registers sreg_dev:8; ++ u8 sreg_addr; ++ u8 sreg_dev; + }; + + static void nft_dup_ipv4_eval(const struct nft_expr *expr, +@@ -43,16 +43,16 @@ static int nft_dup_ipv4_init(const struc + if (tb[NFTA_DUP_SREG_ADDR] == NULL) + return -EINVAL; + +- priv->sreg_addr = nft_parse_register(tb[NFTA_DUP_SREG_ADDR]); +- err = nft_validate_register_load(priv->sreg_addr, sizeof(struct in_addr)); ++ err = nft_parse_register_load(tb[NFTA_DUP_SREG_ADDR], &priv->sreg_addr, ++ sizeof(struct in_addr)); + if (err < 0) + return err; + +- if (tb[NFTA_DUP_SREG_DEV] != NULL) { +- priv->sreg_dev = nft_parse_register(tb[NFTA_DUP_SREG_DEV]); +- return nft_validate_register_load(priv->sreg_dev, sizeof(int)); +- } +- return 0; ++ if (tb[NFTA_DUP_SREG_DEV]) ++ err = nft_parse_register_load(tb[NFTA_DUP_SREG_DEV], ++ &priv->sreg_dev, sizeof(int)); ++ ++ return err; + } + + static int nft_dup_ipv4_dump(struct sk_buff *skb, const struct nft_expr *expr) +--- a/net/ipv6/netfilter/nft_dup_ipv6.c ++++ b/net/ipv6/netfilter/nft_dup_ipv6.c +@@ -16,8 +16,8 @@ + #include + + struct nft_dup_ipv6 { +- enum nft_registers sreg_addr:8; +- enum nft_registers sreg_dev:8; ++ u8 sreg_addr; ++ u8 sreg_dev; + }; + + static void nft_dup_ipv6_eval(const struct nft_expr *expr, +@@ -41,16 +41,16 @@ static int nft_dup_ipv6_init(const struc + if (tb[NFTA_DUP_SREG_ADDR] == NULL) + return -EINVAL; + +- priv->sreg_addr = nft_parse_register(tb[NFTA_DUP_SREG_ADDR]); +- err = nft_validate_register_load(priv->sreg_addr, sizeof(struct in6_addr)); ++ err = nft_parse_register_load(tb[NFTA_DUP_SREG_ADDR], &priv->sreg_addr, ++ sizeof(struct in6_addr)); + if (err < 0) + return err; + +- if (tb[NFTA_DUP_SREG_DEV] != NULL) { +- priv->sreg_dev = nft_parse_register(tb[NFTA_DUP_SREG_DEV]); +- return nft_validate_register_load(priv->sreg_dev, sizeof(int)); +- } +- return 0; ++ if (tb[NFTA_DUP_SREG_DEV]) ++ err = nft_parse_register_load(tb[NFTA_DUP_SREG_DEV], ++ &priv->sreg_dev, sizeof(int)); ++ ++ return err; + } + + static int nft_dup_ipv6_dump(struct sk_buff *skb, const struct nft_expr *expr) +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5663,7 +5663,7 @@ EXPORT_SYMBOL_GPL(nft_dump_register); + * Validate that the input register is one of the general purpose + * registers and that the length of the load is within the bounds. + */ +-int nft_validate_register_load(enum nft_registers reg, unsigned int len) ++static int nft_validate_register_load(enum nft_registers reg, unsigned int len) + { + if (reg < NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE) + return -EINVAL; +@@ -5674,7 +5674,21 @@ int nft_validate_register_load(enum nft_ + + return 0; + } +-EXPORT_SYMBOL_GPL(nft_validate_register_load); ++ ++int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len) ++{ ++ u32 reg; ++ int err; ++ ++ reg = nft_parse_register(attr); ++ err = nft_validate_register_load(reg, len); ++ if (err < 0) ++ return err; ++ ++ *sreg = reg; ++ return 0; ++} ++EXPORT_SYMBOL_GPL(nft_parse_register_load); + + /** + * nft_validate_register_store - validate an expressions' register store +--- a/net/netfilter/nft_bitwise.c ++++ b/net/netfilter/nft_bitwise.c +@@ -18,7 +18,7 @@ + #include + + struct nft_bitwise { +- enum nft_registers sreg:8; ++ u8 sreg; + enum nft_registers dreg:8; + u8 len; + struct nft_data mask; +@@ -68,8 +68,8 @@ static int nft_bitwise_init(const struct + + priv->len = len; + +- priv->sreg = nft_parse_register(tb[NFTA_BITWISE_SREG]); +- err = nft_validate_register_load(priv->sreg, priv->len); ++ err = nft_parse_register_load(tb[NFTA_BITWISE_SREG], &priv->sreg, ++ priv->len); + if (err < 0) + return err; + +--- a/net/netfilter/nft_byteorder.c ++++ b/net/netfilter/nft_byteorder.c +@@ -19,7 +19,7 @@ + #include + + struct nft_byteorder { +- enum nft_registers sreg:8; ++ u8 sreg; + enum nft_registers dreg:8; + enum nft_byteorder_ops op:8; + u8 len; +@@ -133,14 +133,14 @@ static int nft_byteorder_init(const stru + return -EINVAL; + } + +- priv->sreg = nft_parse_register(tb[NFTA_BYTEORDER_SREG]); + err = nft_parse_u32_check(tb[NFTA_BYTEORDER_LEN], U8_MAX, &len); + if (err < 0) + return err; + + priv->len = len; + +- err = nft_validate_register_load(priv->sreg, priv->len); ++ err = nft_parse_register_load(tb[NFTA_BYTEORDER_SREG], &priv->sreg, ++ priv->len); + if (err < 0) + return err; + +--- a/net/netfilter/nft_cmp.c ++++ b/net/netfilter/nft_cmp.c +@@ -19,7 +19,7 @@ + + struct nft_cmp_expr { + struct nft_data data; +- enum nft_registers sreg:8; ++ u8 sreg; + u8 len; + enum nft_cmp_ops op:8; + }; +@@ -79,8 +79,7 @@ static int nft_cmp_init(const struct nft + tb[NFTA_CMP_DATA]); + BUG_ON(err < 0); + +- priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]); +- err = nft_validate_register_load(priv->sreg, desc.len); ++ err = nft_parse_register_load(tb[NFTA_CMP_SREG], &priv->sreg, desc.len); + if (err < 0) + return err; + +@@ -129,8 +128,7 @@ static int nft_cmp_fast_init(const struc + tb[NFTA_CMP_DATA]); + BUG_ON(err < 0); + +- priv->sreg = nft_parse_register(tb[NFTA_CMP_SREG]); +- err = nft_validate_register_load(priv->sreg, desc.len); ++ err = nft_parse_register_load(tb[NFTA_CMP_SREG], &priv->sreg, desc.len); + if (err < 0) + return err; + +--- a/net/netfilter/nft_ct.c ++++ b/net/netfilter/nft_ct.c +@@ -28,7 +28,7 @@ struct nft_ct { + enum ip_conntrack_dir dir:8; + union { + enum nft_registers dreg:8; +- enum nft_registers sreg:8; ++ u8 sreg; + }; + }; + +@@ -578,8 +578,7 @@ static int nft_ct_set_init(const struct + } + } + +- priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]); +- err = nft_validate_register_load(priv->sreg, len); ++ err = nft_parse_register_load(tb[NFTA_CT_SREG], &priv->sreg, len); + if (err < 0) + goto err1; + +--- a/net/netfilter/nft_dup_netdev.c ++++ b/net/netfilter/nft_dup_netdev.c +@@ -16,7 +16,7 @@ + #include + + struct nft_dup_netdev { +- enum nft_registers sreg_dev:8; ++ u8 sreg_dev; + }; + + static void nft_dup_netdev_eval(const struct nft_expr *expr, +@@ -42,8 +42,8 @@ static int nft_dup_netdev_init(const str + if (tb[NFTA_DUP_SREG_DEV] == NULL) + return -EINVAL; + +- priv->sreg_dev = nft_parse_register(tb[NFTA_DUP_SREG_DEV]); +- return nft_validate_register_load(priv->sreg_dev, sizeof(int)); ++ return nft_parse_register_load(tb[NFTA_DUP_SREG_DEV], &priv->sreg_dev, ++ sizeof(int)); + } + + static const struct nft_expr_ops nft_dup_netdev_ingress_ops; +--- a/net/netfilter/nft_dynset.c ++++ b/net/netfilter/nft_dynset.c +@@ -20,8 +20,8 @@ struct nft_dynset { + struct nft_set *set; + struct nft_set_ext_tmpl tmpl; + enum nft_dynset_ops op:8; +- enum nft_registers sreg_key:8; +- enum nft_registers sreg_data:8; ++ u8 sreg_key; ++ u8 sreg_data; + bool invert; + u64 timeout; + struct nft_expr *expr; +@@ -163,8 +163,8 @@ static int nft_dynset_init(const struct + tb[NFTA_DYNSET_TIMEOUT]))); + } + +- priv->sreg_key = nft_parse_register(tb[NFTA_DYNSET_SREG_KEY]); +- err = nft_validate_register_load(priv->sreg_key, set->klen);; ++ err = nft_parse_register_load(tb[NFTA_DYNSET_SREG_KEY], &priv->sreg_key, ++ set->klen); + if (err < 0) + return err; + +@@ -174,8 +174,8 @@ static int nft_dynset_init(const struct + if (set->dtype == NFT_DATA_VERDICT) + return -EOPNOTSUPP; + +- priv->sreg_data = nft_parse_register(tb[NFTA_DYNSET_SREG_DATA]); +- err = nft_validate_register_load(priv->sreg_data, set->dlen); ++ err = nft_parse_register_load(tb[NFTA_DYNSET_SREG_DATA], ++ &priv->sreg_data, set->dlen); + if (err < 0) + return err; + } else if (set->flags & NFT_SET_MAP) +--- a/net/netfilter/nft_exthdr.c ++++ b/net/netfilter/nft_exthdr.c +@@ -24,7 +24,7 @@ struct nft_exthdr { + u8 len; + u8 op; + enum nft_registers dreg:8; +- enum nft_registers sreg:8; ++ u8 sreg; + u8 flags; + }; + +@@ -307,11 +307,11 @@ static int nft_exthdr_tcp_set_init(const + priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]); + priv->offset = offset; + priv->len = len; +- priv->sreg = nft_parse_register(tb[NFTA_EXTHDR_SREG]); + priv->flags = flags; + priv->op = op; + +- return nft_validate_register_load(priv->sreg, priv->len); ++ return nft_parse_register_load(tb[NFTA_EXTHDR_SREG], &priv->sreg, ++ priv->len); + } + + static int nft_exthdr_dump_common(struct sk_buff *skb, const struct nft_exthdr *priv) +--- a/net/netfilter/nft_fwd_netdev.c ++++ b/net/netfilter/nft_fwd_netdev.c +@@ -16,7 +16,7 @@ + #include + + struct nft_fwd_netdev { +- enum nft_registers sreg_dev:8; ++ u8 sreg_dev; + }; + + static void nft_fwd_netdev_eval(const struct nft_expr *expr, +@@ -43,8 +43,8 @@ static int nft_fwd_netdev_init(const str + if (tb[NFTA_FWD_SREG_DEV] == NULL) + return -EINVAL; + +- priv->sreg_dev = nft_parse_register(tb[NFTA_FWD_SREG_DEV]); +- return nft_validate_register_load(priv->sreg_dev, sizeof(int)); ++ return nft_parse_register_load(tb[NFTA_FWD_SREG_DEV], &priv->sreg_dev, ++ sizeof(int)); + } + + static const struct nft_expr_ops nft_fwd_netdev_ingress_ops; +--- a/net/netfilter/nft_hash.c ++++ b/net/netfilter/nft_hash.c +@@ -18,7 +18,7 @@ + #include + + struct nft_jhash { +- enum nft_registers sreg:8; ++ u8 sreg; + enum nft_registers dreg:8; + u8 len; + bool autogen_seed:1; +@@ -85,7 +85,6 @@ static int nft_jhash_init(const struct n + if (tb[NFTA_HASH_OFFSET]) + priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET])); + +- priv->sreg = nft_parse_register(tb[NFTA_HASH_SREG]); + priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]); + + err = nft_parse_u32_check(tb[NFTA_HASH_LEN], U8_MAX, &len); +@@ -96,6 +95,10 @@ static int nft_jhash_init(const struct n + + priv->len = len; + ++ err = nft_parse_register_load(tb[NFTA_HASH_SREG], &priv->sreg, len); ++ if (err < 0) ++ return err; ++ + priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS])); + if (priv->modulus <= 1) + return -ERANGE; +@@ -110,8 +113,7 @@ static int nft_jhash_init(const struct n + get_random_bytes(&priv->seed, sizeof(priv->seed)); + } + +- return nft_validate_register_load(priv->sreg, len) && +- nft_validate_register_store(ctx, priv->dreg, NULL, ++ return nft_validate_register_store(ctx, priv->dreg, NULL, + NFT_DATA_VALUE, sizeof(u32)); + } + +--- a/net/netfilter/nft_lookup.c ++++ b/net/netfilter/nft_lookup.c +@@ -20,7 +20,7 @@ + + struct nft_lookup { + struct nft_set *set; +- enum nft_registers sreg:8; ++ u8 sreg; + enum nft_registers dreg:8; + bool invert; + struct nft_set_binding binding; +@@ -76,8 +76,8 @@ static int nft_lookup_init(const struct + if (IS_ERR(set)) + return PTR_ERR(set); + +- priv->sreg = nft_parse_register(tb[NFTA_LOOKUP_SREG]); +- err = nft_validate_register_load(priv->sreg, set->klen); ++ err = nft_parse_register_load(tb[NFTA_LOOKUP_SREG], &priv->sreg, ++ set->klen); + if (err < 0) + return err; + +--- a/net/netfilter/nft_masq.c ++++ b/net/netfilter/nft_masq.c +@@ -53,19 +53,15 @@ int nft_masq_init(const struct nft_ctx * + } + + if (tb[NFTA_MASQ_REG_PROTO_MIN]) { +- priv->sreg_proto_min = +- nft_parse_register(tb[NFTA_MASQ_REG_PROTO_MIN]); +- +- err = nft_validate_register_load(priv->sreg_proto_min, plen); ++ err = nft_parse_register_load(tb[NFTA_MASQ_REG_PROTO_MIN], ++ &priv->sreg_proto_min, plen); + if (err < 0) + return err; + + if (tb[NFTA_MASQ_REG_PROTO_MAX]) { +- priv->sreg_proto_max = +- nft_parse_register(tb[NFTA_MASQ_REG_PROTO_MAX]); +- +- err = nft_validate_register_load(priv->sreg_proto_max, +- plen); ++ err = nft_parse_register_load(tb[NFTA_MASQ_REG_PROTO_MAX], ++ &priv->sreg_proto_max, ++ plen); + if (err < 0) + return err; + } else { +--- a/net/netfilter/nft_meta.c ++++ b/net/netfilter/nft_meta.c +@@ -374,8 +374,7 @@ int nft_meta_set_init(const struct nft_c + return -EOPNOTSUPP; + } + +- priv->sreg = nft_parse_register(tb[NFTA_META_SREG]); +- err = nft_validate_register_load(priv->sreg, len); ++ err = nft_parse_register_load(tb[NFTA_META_SREG], &priv->sreg, len); + if (err < 0) + return err; + +--- a/net/netfilter/nft_nat.c ++++ b/net/netfilter/nft_nat.c +@@ -27,10 +27,10 @@ + #include + + struct nft_nat { +- enum nft_registers sreg_addr_min:8; +- enum nft_registers sreg_addr_max:8; +- enum nft_registers sreg_proto_min:8; +- enum nft_registers sreg_proto_max:8; ++ u8 sreg_addr_min; ++ u8 sreg_addr_max; ++ u8 sreg_proto_min; ++ u8 sreg_proto_max; + enum nf_nat_manip_type type:8; + u8 family; + u16 flags; +@@ -160,18 +160,15 @@ static int nft_nat_init(const struct nft + priv->family = family; + + if (tb[NFTA_NAT_REG_ADDR_MIN]) { +- priv->sreg_addr_min = +- nft_parse_register(tb[NFTA_NAT_REG_ADDR_MIN]); +- err = nft_validate_register_load(priv->sreg_addr_min, alen); ++ err = nft_parse_register_load(tb[NFTA_NAT_REG_ADDR_MIN], ++ &priv->sreg_addr_min, alen); + if (err < 0) + return err; + + if (tb[NFTA_NAT_REG_ADDR_MAX]) { +- priv->sreg_addr_max = +- nft_parse_register(tb[NFTA_NAT_REG_ADDR_MAX]); +- +- err = nft_validate_register_load(priv->sreg_addr_max, +- alen); ++ err = nft_parse_register_load(tb[NFTA_NAT_REG_ADDR_MAX], ++ &priv->sreg_addr_max, ++ alen); + if (err < 0) + return err; + } else { +@@ -181,19 +178,15 @@ static int nft_nat_init(const struct nft + + plen = FIELD_SIZEOF(struct nf_nat_range, min_addr.all); + if (tb[NFTA_NAT_REG_PROTO_MIN]) { +- priv->sreg_proto_min = +- nft_parse_register(tb[NFTA_NAT_REG_PROTO_MIN]); +- +- err = nft_validate_register_load(priv->sreg_proto_min, plen); ++ err = nft_parse_register_load(tb[NFTA_NAT_REG_PROTO_MIN], ++ &priv->sreg_proto_min, plen); + if (err < 0) + return err; + + if (tb[NFTA_NAT_REG_PROTO_MAX]) { +- priv->sreg_proto_max = +- nft_parse_register(tb[NFTA_NAT_REG_PROTO_MAX]); +- +- err = nft_validate_register_load(priv->sreg_proto_max, +- plen); ++ err = nft_parse_register_load(tb[NFTA_NAT_REG_PROTO_MAX], ++ &priv->sreg_proto_max, ++ plen); + if (err < 0) + return err; + } else { +--- a/net/netfilter/nft_objref.c ++++ b/net/netfilter/nft_objref.c +@@ -97,7 +97,7 @@ static const struct nft_expr_ops nft_obj + + struct nft_objref_map { + struct nft_set *set; +- enum nft_registers sreg:8; ++ u8 sreg; + struct nft_set_binding binding; + }; + +@@ -138,8 +138,8 @@ static int nft_objref_map_init(const str + if (!(set->flags & NFT_SET_OBJECT)) + return -EINVAL; + +- priv->sreg = nft_parse_register(tb[NFTA_OBJREF_SET_SREG]); +- err = nft_validate_register_load(priv->sreg, set->klen); ++ err = nft_parse_register_load(tb[NFTA_OBJREF_SET_SREG], &priv->sreg, ++ set->klen); + if (err < 0) + return err; + +--- a/net/netfilter/nft_payload.c ++++ b/net/netfilter/nft_payload.c +@@ -338,7 +338,6 @@ static int nft_payload_set_init(const st + priv->base = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_BASE])); + priv->offset = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_OFFSET])); + priv->len = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN])); +- priv->sreg = nft_parse_register(tb[NFTA_PAYLOAD_SREG]); + + if (tb[NFTA_PAYLOAD_CSUM_TYPE]) + csum_type = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_CSUM_TYPE])); +@@ -369,7 +368,8 @@ static int nft_payload_set_init(const st + } + priv->csum_type = csum_type; + +- return nft_validate_register_load(priv->sreg, priv->len); ++ return nft_parse_register_load(tb[NFTA_PAYLOAD_SREG], &priv->sreg, ++ priv->len); + } + + static int nft_payload_set_dump(struct sk_buff *skb, const struct nft_expr *expr) +--- a/net/netfilter/nft_queue.c ++++ b/net/netfilter/nft_queue.c +@@ -22,10 +22,10 @@ + static u32 jhash_initval __read_mostly; + + struct nft_queue { +- enum nft_registers sreg_qnum:8; +- u16 queuenum; +- u16 queues_total; +- u16 flags; ++ u8 sreg_qnum; ++ u16 queuenum; ++ u16 queues_total; ++ u16 flags; + }; + + static void nft_queue_eval(const struct nft_expr *expr, +@@ -114,8 +114,8 @@ static int nft_queue_sreg_init(const str + struct nft_queue *priv = nft_expr_priv(expr); + int err; + +- priv->sreg_qnum = nft_parse_register(tb[NFTA_QUEUE_SREG_QNUM]); +- err = nft_validate_register_load(priv->sreg_qnum, sizeof(u32)); ++ err = nft_parse_register_load(tb[NFTA_QUEUE_SREG_QNUM], ++ &priv->sreg_qnum, sizeof(u32)); + if (err < 0) + return err; + +--- a/net/netfilter/nft_range.c ++++ b/net/netfilter/nft_range.c +@@ -18,7 +18,7 @@ + struct nft_range_expr { + struct nft_data data_from; + struct nft_data data_to; +- enum nft_registers sreg:8; ++ u8 sreg; + u8 len; + enum nft_range_ops op:8; + }; +@@ -80,8 +80,8 @@ static int nft_range_init(const struct n + goto err2; + } + +- priv->sreg = nft_parse_register(tb[NFTA_RANGE_SREG]); +- err = nft_validate_register_load(priv->sreg, desc_from.len); ++ err = nft_parse_register_load(tb[NFTA_RANGE_SREG], &priv->sreg, ++ desc_from.len); + if (err < 0) + goto err2; + +--- a/net/netfilter/nft_redir.c ++++ b/net/netfilter/nft_redir.c +@@ -49,19 +49,15 @@ int nft_redir_init(const struct nft_ctx + + plen = FIELD_SIZEOF(struct nf_nat_range, min_addr.all); + if (tb[NFTA_REDIR_REG_PROTO_MIN]) { +- priv->sreg_proto_min = +- nft_parse_register(tb[NFTA_REDIR_REG_PROTO_MIN]); +- +- err = nft_validate_register_load(priv->sreg_proto_min, plen); ++ err = nft_parse_register_load(tb[NFTA_REDIR_REG_PROTO_MIN], ++ &priv->sreg_proto_min, plen); + if (err < 0) + return err; + + if (tb[NFTA_REDIR_REG_PROTO_MAX]) { +- priv->sreg_proto_max = +- nft_parse_register(tb[NFTA_REDIR_REG_PROTO_MAX]); +- +- err = nft_validate_register_load(priv->sreg_proto_max, +- plen); ++ err = nft_parse_register_load(tb[NFTA_REDIR_REG_PROTO_MAX], ++ &priv->sreg_proto_max, ++ plen); + if (err < 0) + return err; + } else { diff --git a/queue-4.14/netfilter-nftables-add-nft_parse_register_store-and-use-it.patch b/queue-4.14/netfilter-nftables-add-nft_parse_register_store-and-use-it.patch new file mode 100644 index 00000000000..07ae82037b6 --- /dev/null +++ b/queue-4.14/netfilter-nftables-add-nft_parse_register_store-and-use-it.patch @@ -0,0 +1,507 @@ +From stable-owner@vger.kernel.org Sat May 27 16:08:11 2023 +From: Pablo Neira Ayuso +Date: Sat, 27 May 2023 18:08:02 +0200 +Subject: netfilter: nftables: add nft_parse_register_store() and use it +To: netfilter-devel@vger.kernel.org +Cc: gregkh@linuxfoundation.org, stable@vger.kernel.org, sashal@kernel.org +Message-ID: <20230527160811.67779-3-pablo@netfilter.org> + +From: Pablo Neira Ayuso + +[ 345023b0db315648ccc3c1a36aee88304a8b4d91 ] + +This new function combines the netlink register attribute parser +and the store validation function. + +This update requires to replace: + + enum nft_registers dreg:8; + +in many of the expression private areas otherwise compiler complains +with: + + error: cannot take address of bit-field ‘dreg’ + +when passing the register field as reference. + +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + include/net/netfilter/nf_tables.h | 8 +++---- + include/net/netfilter/nf_tables_core.h | 4 +-- + include/net/netfilter/nft_fib.h | 2 - + include/net/netfilter/nft_meta.h | 2 - + net/bridge/netfilter/nft_meta_bridge.c | 5 +--- + net/netfilter/nf_tables_api.c | 34 ++++++++++++++++++++++++++++----- + net/netfilter/nft_bitwise.c | 8 +++---- + net/netfilter/nft_byteorder.c | 8 +++---- + net/netfilter/nft_ct.c | 7 ++---- + net/netfilter/nft_exthdr.c | 8 +++---- + net/netfilter/nft_fib.c | 5 +--- + net/netfilter/nft_hash.c | 17 ++++++---------- + net/netfilter/nft_immediate.c | 8 +++---- + net/netfilter/nft_lookup.c | 8 +++---- + net/netfilter/nft_meta.c | 5 +--- + net/netfilter/nft_numgen.c | 15 +++++--------- + net/netfilter/nft_payload.c | 6 ++--- + net/netfilter/nft_rt.c | 7 ++---- + 18 files changed, 85 insertions(+), 72 deletions(-) + +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -199,10 +199,10 @@ unsigned int nft_parse_register(const st + int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg); + + int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len); +-int nft_validate_register_store(const struct nft_ctx *ctx, +- enum nft_registers reg, +- const struct nft_data *data, +- enum nft_data_types type, unsigned int len); ++int nft_parse_register_store(const struct nft_ctx *ctx, ++ const struct nlattr *attr, u8 *dreg, ++ const struct nft_data *data, ++ enum nft_data_types type, unsigned int len); + + /** + * struct nft_userdata - user defined data associated with an object +--- a/include/net/netfilter/nf_tables_core.h ++++ b/include/net/netfilter/nf_tables_core.h +@@ -18,7 +18,7 @@ struct nft_bitwise_fast_expr { + u32 mask; + u32 xor; + u8 sreg; +- enum nft_registers dreg:8; ++ u8 dreg; + }; + + struct nft_cmp_fast_expr { +@@ -44,7 +44,7 @@ struct nft_payload { + enum nft_payload_bases base:8; + u8 offset; + u8 len; +- enum nft_registers dreg:8; ++ u8 dreg; + }; + + struct nft_payload_set { +--- a/include/net/netfilter/nft_fib.h ++++ b/include/net/netfilter/nft_fib.h +@@ -3,7 +3,7 @@ + #define _NFT_FIB_H_ + + struct nft_fib { +- enum nft_registers dreg:8; ++ u8 dreg; + u8 result; + u32 flags; + }; +--- a/include/net/netfilter/nft_meta.h ++++ b/include/net/netfilter/nft_meta.h +@@ -5,7 +5,7 @@ + struct nft_meta { + enum nft_meta_keys key:8; + union { +- enum nft_registers dreg:8; ++ u8 dreg; + u8 sreg; + }; + }; +--- a/net/bridge/netfilter/nft_meta_bridge.c ++++ b/net/bridge/netfilter/nft_meta_bridge.c +@@ -65,9 +65,8 @@ static int nft_meta_bridge_get_init(cons + return nft_meta_get_init(ctx, expr, tb); + } + +- priv->dreg = nft_parse_register(tb[NFTA_META_DREG]); +- return nft_validate_register_store(ctx, priv->dreg, NULL, +- NFT_DATA_VALUE, len); ++ return nft_parse_register_store(ctx, tb[NFTA_META_DREG], &priv->dreg, ++ NULL, NFT_DATA_VALUE, len); + } + + static struct nft_expr_type nft_meta_bridge_type; +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -3349,6 +3349,12 @@ static int nf_tables_delset(struct net * + return nft_delset(&ctx, set); + } + ++static int nft_validate_register_store(const struct nft_ctx *ctx, ++ enum nft_registers reg, ++ const struct nft_data *data, ++ enum nft_data_types type, ++ unsigned int len); ++ + static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx, + struct nft_set *set, + const struct nft_set_iter *iter, +@@ -5704,10 +5710,11 @@ EXPORT_SYMBOL_GPL(nft_parse_register_loa + * A value of NULL for the data means that its runtime gathered + * data. + */ +-int nft_validate_register_store(const struct nft_ctx *ctx, +- enum nft_registers reg, +- const struct nft_data *data, +- enum nft_data_types type, unsigned int len) ++static int nft_validate_register_store(const struct nft_ctx *ctx, ++ enum nft_registers reg, ++ const struct nft_data *data, ++ enum nft_data_types type, ++ unsigned int len) + { + int err; + +@@ -5746,7 +5753,24 @@ int nft_validate_register_store(const st + return 0; + } + } +-EXPORT_SYMBOL_GPL(nft_validate_register_store); ++ ++int nft_parse_register_store(const struct nft_ctx *ctx, ++ const struct nlattr *attr, u8 *dreg, ++ const struct nft_data *data, ++ enum nft_data_types type, unsigned int len) ++{ ++ int err; ++ u32 reg; ++ ++ reg = nft_parse_register(attr); ++ err = nft_validate_register_store(ctx, reg, data, type, len); ++ if (err < 0) ++ return err; ++ ++ *dreg = reg; ++ return 0; ++} ++EXPORT_SYMBOL_GPL(nft_parse_register_store); + + static const struct nla_policy nft_verdict_policy[NFTA_VERDICT_MAX + 1] = { + [NFTA_VERDICT_CODE] = { .type = NLA_U32 }, +--- a/net/netfilter/nft_bitwise.c ++++ b/net/netfilter/nft_bitwise.c +@@ -19,7 +19,7 @@ + + struct nft_bitwise { + u8 sreg; +- enum nft_registers dreg:8; ++ u8 dreg; + u8 len; + struct nft_data mask; + struct nft_data xor; +@@ -73,9 +73,9 @@ static int nft_bitwise_init(const struct + if (err < 0) + return err; + +- priv->dreg = nft_parse_register(tb[NFTA_BITWISE_DREG]); +- err = nft_validate_register_store(ctx, priv->dreg, NULL, +- NFT_DATA_VALUE, priv->len); ++ err = nft_parse_register_store(ctx, tb[NFTA_BITWISE_DREG], ++ &priv->dreg, NULL, NFT_DATA_VALUE, ++ priv->len); + if (err < 0) + return err; + +--- a/net/netfilter/nft_byteorder.c ++++ b/net/netfilter/nft_byteorder.c +@@ -20,7 +20,7 @@ + + struct nft_byteorder { + u8 sreg; +- enum nft_registers dreg:8; ++ u8 dreg; + enum nft_byteorder_ops op:8; + u8 len; + u8 size; +@@ -144,9 +144,9 @@ static int nft_byteorder_init(const stru + if (err < 0) + return err; + +- priv->dreg = nft_parse_register(tb[NFTA_BYTEORDER_DREG]); +- return nft_validate_register_store(ctx, priv->dreg, NULL, +- NFT_DATA_VALUE, priv->len); ++ return nft_parse_register_store(ctx, tb[NFTA_BYTEORDER_DREG], ++ &priv->dreg, NULL, NFT_DATA_VALUE, ++ priv->len); + } + + static int nft_byteorder_dump(struct sk_buff *skb, const struct nft_expr *expr) +--- a/net/netfilter/nft_ct.c ++++ b/net/netfilter/nft_ct.c +@@ -27,7 +27,7 @@ struct nft_ct { + enum nft_ct_keys key:8; + enum ip_conntrack_dir dir:8; + union { +- enum nft_registers dreg:8; ++ u8 dreg; + u8 sreg; + }; + }; +@@ -483,9 +483,8 @@ static int nft_ct_get_init(const struct + } + } + +- priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]); +- err = nft_validate_register_store(ctx, priv->dreg, NULL, +- NFT_DATA_VALUE, len); ++ err = nft_parse_register_store(ctx, tb[NFTA_CT_DREG], &priv->dreg, NULL, ++ NFT_DATA_VALUE, len); + if (err < 0) + return err; + +--- a/net/netfilter/nft_exthdr.c ++++ b/net/netfilter/nft_exthdr.c +@@ -23,7 +23,7 @@ struct nft_exthdr { + u8 offset; + u8 len; + u8 op; +- enum nft_registers dreg:8; ++ u8 dreg; + u8 sreg; + u8 flags; + }; +@@ -257,12 +257,12 @@ static int nft_exthdr_init(const struct + priv->type = nla_get_u8(tb[NFTA_EXTHDR_TYPE]); + priv->offset = offset; + priv->len = len; +- priv->dreg = nft_parse_register(tb[NFTA_EXTHDR_DREG]); + priv->flags = flags; + priv->op = op; + +- return nft_validate_register_store(ctx, priv->dreg, NULL, +- NFT_DATA_VALUE, priv->len); ++ return nft_parse_register_store(ctx, tb[NFTA_EXTHDR_DREG], ++ &priv->dreg, NULL, NFT_DATA_VALUE, ++ priv->len); + } + + static int nft_exthdr_tcp_set_init(const struct nft_ctx *ctx, +--- a/net/netfilter/nft_fib.c ++++ b/net/netfilter/nft_fib.c +@@ -88,7 +88,6 @@ int nft_fib_init(const struct nft_ctx *c + return -EINVAL; + + priv->result = ntohl(nla_get_be32(tb[NFTA_FIB_RESULT])); +- priv->dreg = nft_parse_register(tb[NFTA_FIB_DREG]); + + switch (priv->result) { + case NFT_FIB_RESULT_OIF: +@@ -108,8 +107,8 @@ int nft_fib_init(const struct nft_ctx *c + return -EINVAL; + } + +- err = nft_validate_register_store(ctx, priv->dreg, NULL, +- NFT_DATA_VALUE, len); ++ err = nft_parse_register_store(ctx, tb[NFTA_FIB_DREG], &priv->dreg, ++ NULL, NFT_DATA_VALUE, len); + if (err < 0) + return err; + +--- a/net/netfilter/nft_hash.c ++++ b/net/netfilter/nft_hash.c +@@ -19,7 +19,7 @@ + + struct nft_jhash { + u8 sreg; +- enum nft_registers dreg:8; ++ u8 dreg; + u8 len; + bool autogen_seed:1; + u32 modulus; +@@ -40,7 +40,7 @@ static void nft_jhash_eval(const struct + } + + struct nft_symhash { +- enum nft_registers dreg:8; ++ u8 dreg; + u32 modulus; + u32 offset; + }; +@@ -85,8 +85,6 @@ static int nft_jhash_init(const struct n + if (tb[NFTA_HASH_OFFSET]) + priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET])); + +- priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]); +- + err = nft_parse_u32_check(tb[NFTA_HASH_LEN], U8_MAX, &len); + if (err < 0) + return err; +@@ -113,8 +111,8 @@ static int nft_jhash_init(const struct n + get_random_bytes(&priv->seed, sizeof(priv->seed)); + } + +- return nft_validate_register_store(ctx, priv->dreg, NULL, +- NFT_DATA_VALUE, sizeof(u32)); ++ return nft_parse_register_store(ctx, tb[NFTA_HASH_DREG], &priv->dreg, ++ NULL, NFT_DATA_VALUE, sizeof(u32)); + } + + static int nft_symhash_init(const struct nft_ctx *ctx, +@@ -130,8 +128,6 @@ static int nft_symhash_init(const struct + if (tb[NFTA_HASH_OFFSET]) + priv->offset = ntohl(nla_get_be32(tb[NFTA_HASH_OFFSET])); + +- priv->dreg = nft_parse_register(tb[NFTA_HASH_DREG]); +- + priv->modulus = ntohl(nla_get_be32(tb[NFTA_HASH_MODULUS])); + if (priv->modulus < 1) + return -ERANGE; +@@ -139,8 +135,9 @@ static int nft_symhash_init(const struct + if (priv->offset + priv->modulus - 1 < priv->offset) + return -EOVERFLOW; + +- return nft_validate_register_store(ctx, priv->dreg, NULL, +- NFT_DATA_VALUE, sizeof(u32)); ++ return nft_parse_register_store(ctx, tb[NFTA_HASH_DREG], ++ &priv->dreg, NULL, NFT_DATA_VALUE, ++ sizeof(u32)); + } + + static int nft_jhash_dump(struct sk_buff *skb, +--- a/net/netfilter/nft_immediate.c ++++ b/net/netfilter/nft_immediate.c +@@ -19,7 +19,7 @@ + + struct nft_immediate_expr { + struct nft_data data; +- enum nft_registers dreg:8; ++ u8 dreg; + u8 dlen; + }; + +@@ -56,9 +56,9 @@ static int nft_immediate_init(const stru + + priv->dlen = desc.len; + +- priv->dreg = nft_parse_register(tb[NFTA_IMMEDIATE_DREG]); +- err = nft_validate_register_store(ctx, priv->dreg, &priv->data, +- desc.type, desc.len); ++ err = nft_parse_register_store(ctx, tb[NFTA_IMMEDIATE_DREG], ++ &priv->dreg, &priv->data, desc.type, ++ desc.len); + if (err < 0) + goto err1; + +--- a/net/netfilter/nft_lookup.c ++++ b/net/netfilter/nft_lookup.c +@@ -21,7 +21,7 @@ + struct nft_lookup { + struct nft_set *set; + u8 sreg; +- enum nft_registers dreg:8; ++ u8 dreg; + bool invert; + struct nft_set_binding binding; + }; +@@ -100,9 +100,9 @@ static int nft_lookup_init(const struct + if (!(set->flags & NFT_SET_MAP)) + return -EINVAL; + +- priv->dreg = nft_parse_register(tb[NFTA_LOOKUP_DREG]); +- err = nft_validate_register_store(ctx, priv->dreg, NULL, +- set->dtype, set->dlen); ++ err = nft_parse_register_store(ctx, tb[NFTA_LOOKUP_DREG], ++ &priv->dreg, NULL, set->dtype, ++ set->dlen); + if (err < 0) + return err; + } else if (set->flags & NFT_SET_MAP) +--- a/net/netfilter/nft_meta.c ++++ b/net/netfilter/nft_meta.c +@@ -314,9 +314,8 @@ int nft_meta_get_init(const struct nft_c + return -EOPNOTSUPP; + } + +- priv->dreg = nft_parse_register(tb[NFTA_META_DREG]); +- return nft_validate_register_store(ctx, priv->dreg, NULL, +- NFT_DATA_VALUE, len); ++ return nft_parse_register_store(ctx, tb[NFTA_META_DREG], &priv->dreg, ++ NULL, NFT_DATA_VALUE, len); + } + EXPORT_SYMBOL_GPL(nft_meta_get_init); + +--- a/net/netfilter/nft_numgen.c ++++ b/net/netfilter/nft_numgen.c +@@ -20,7 +20,7 @@ + static DEFINE_PER_CPU(struct rnd_state, nft_numgen_prandom_state); + + struct nft_ng_inc { +- enum nft_registers dreg:8; ++ u8 dreg; + u32 modulus; + atomic_t counter; + u32 offset; +@@ -64,11 +64,10 @@ static int nft_ng_inc_init(const struct + if (priv->offset + priv->modulus - 1 < priv->offset) + return -EOVERFLOW; + +- priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]); + atomic_set(&priv->counter, priv->modulus - 1); + +- return nft_validate_register_store(ctx, priv->dreg, NULL, +- NFT_DATA_VALUE, sizeof(u32)); ++ return nft_parse_register_store(ctx, tb[NFTA_NG_DREG], &priv->dreg, ++ NULL, NFT_DATA_VALUE, sizeof(u32)); + } + + static int nft_ng_dump(struct sk_buff *skb, enum nft_registers dreg, +@@ -98,7 +97,7 @@ static int nft_ng_inc_dump(struct sk_buf + } + + struct nft_ng_random { +- enum nft_registers dreg:8; ++ u8 dreg; + u32 modulus; + u32 offset; + }; +@@ -133,10 +132,8 @@ static int nft_ng_random_init(const stru + + prandom_init_once(&nft_numgen_prandom_state); + +- priv->dreg = nft_parse_register(tb[NFTA_NG_DREG]); +- +- return nft_validate_register_store(ctx, priv->dreg, NULL, +- NFT_DATA_VALUE, sizeof(u32)); ++ return nft_parse_register_store(ctx, tb[NFTA_NG_DREG], &priv->dreg, ++ NULL, NFT_DATA_VALUE, sizeof(u32)); + } + + static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr) +--- a/net/netfilter/nft_payload.c ++++ b/net/netfilter/nft_payload.c +@@ -135,10 +135,10 @@ static int nft_payload_init(const struct + priv->base = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_BASE])); + priv->offset = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_OFFSET])); + priv->len = ntohl(nla_get_be32(tb[NFTA_PAYLOAD_LEN])); +- priv->dreg = nft_parse_register(tb[NFTA_PAYLOAD_DREG]); + +- return nft_validate_register_store(ctx, priv->dreg, NULL, +- NFT_DATA_VALUE, priv->len); ++ return nft_parse_register_store(ctx, tb[NFTA_PAYLOAD_DREG], ++ &priv->dreg, NULL, NFT_DATA_VALUE, ++ priv->len); + } + + static int nft_payload_dump(struct sk_buff *skb, const struct nft_expr *expr) +--- a/net/netfilter/nft_rt.c ++++ b/net/netfilter/nft_rt.c +@@ -20,7 +20,7 @@ + + struct nft_rt { + enum nft_rt_keys key:8; +- enum nft_registers dreg:8; ++ u8 dreg; + }; + + static u16 get_tcpmss(const struct nft_pktinfo *pkt, const struct dst_entry *skbdst) +@@ -141,9 +141,8 @@ static int nft_rt_get_init(const struct + return -EOPNOTSUPP; + } + +- priv->dreg = nft_parse_register(tb[NFTA_RT_DREG]); +- return nft_validate_register_store(ctx, priv->dreg, NULL, +- NFT_DATA_VALUE, len); ++ return nft_parse_register_store(ctx, tb[NFTA_RT_DREG], &priv->dreg, ++ NULL, NFT_DATA_VALUE, len); + } + + static int nft_rt_get_dump(struct sk_buff *skb, diff --git a/queue-4.14/netfilter-nftables-statify-nft_parse_register.patch b/queue-4.14/netfilter-nftables-statify-nft_parse_register.patch new file mode 100644 index 00000000000..81543675e49 --- /dev/null +++ b/queue-4.14/netfilter-nftables-statify-nft_parse_register.patch @@ -0,0 +1,50 @@ +From stable-owner@vger.kernel.org Sat May 27 16:08:11 2023 +From: Pablo Neira Ayuso +Date: Sat, 27 May 2023 18:08:03 +0200 +Subject: netfilter: nftables: statify nft_parse_register() +To: netfilter-devel@vger.kernel.org +Cc: gregkh@linuxfoundation.org, stable@vger.kernel.org, sashal@kernel.org +Message-ID: <20230527160811.67779-4-pablo@netfilter.org> + +From: Pablo Neira Ayuso + +[ 08a01c11a5bb3de9b0a9c9b2685867e50eda9910 ] + +This function is not used anymore by any extension, statify it. + +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + include/net/netfilter/nf_tables.h | 1 - + net/netfilter/nf_tables_api.c | 3 +-- + 2 files changed, 1 insertion(+), 3 deletions(-) + +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -195,7 +195,6 @@ static inline enum nft_registers nft_typ + } + + int nft_parse_u32_check(const struct nlattr *attr, int max, u32 *dest); +-unsigned int nft_parse_register(const struct nlattr *attr); + int nft_dump_register(struct sk_buff *skb, unsigned int attr, unsigned int reg); + + int nft_parse_register_load(const struct nlattr *attr, u8 *sreg, u32 len); +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5624,7 +5624,7 @@ EXPORT_SYMBOL_GPL(nft_parse_u32_check); + * Registers used to be 128 bit wide, these register numbers will be + * mapped to the corresponding 32 bit register numbers. + */ +-unsigned int nft_parse_register(const struct nlattr *attr) ++static unsigned int nft_parse_register(const struct nlattr *attr) + { + unsigned int reg; + +@@ -5636,7 +5636,6 @@ unsigned int nft_parse_register(const st + return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00; + } + } +-EXPORT_SYMBOL_GPL(nft_parse_register); + + /** + * nft_dump_register - dump a register value to a netlink attribute diff --git a/queue-4.14/series b/queue-4.14/series index 97f8864123c..589b50c7d9e 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -58,3 +58,14 @@ spi-fsl-cpm-use-16-bit-mode-for-large-transfers-with-even-size.patch m68k-move-signal-frame-following-exception-on-68020-030.patch parisc-allow-to-reboot-machine-after-system-halt.patch btrfs-use-nofs-when-cleaning-up-aborted-transactions.patch +netfilter-nftables-add-nft_parse_register_load-and-use-it.patch +netfilter-nftables-add-nft_parse_register_store-and-use-it.patch +netfilter-nftables-statify-nft_parse_register.patch +netfilter-nf_tables-validate-registers-coming-from-userspace.patch +netfilter-nf_tables-add-nft_setelem_parse_key.patch +netfilter-nf_tables-allow-up-to-64-bytes-in-the-set-element-data-area.patch +netfilter-nf_tables-stricter-validation-of-element-data.patch +netfilter-nft_dynset-do-not-reject-set-updates-with-nft_set_eval.patch +netfilter-nf_tables-do-not-allow-rule_id-to-refer-to-another-chain.patch +netfilter-nf_tables-do-not-allow-set_id-to-refer-to-another-table.patch +netfilter-nf_tables-fix-register-ordering.patch