netfilter: nf_tables: do not allow to delete table with owner by handle

[ Upstream commit e31f072ffab0397a328b31a9589dcf9733dc9c72 ]

nft_table_lookup_byhandle() also needs to validate the netlink PortID
owner when deleting a table by handle.

Fixes: 6001a930ce03 ("netfilter: nftables: introduce table ownership")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 3705086d43f500cfe44ba89450ab059585cae1f2..6b79fa357bfea5ca26a3fb2a753a42e65bbca796 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -533,14 +533,19 @@ static struct nft_table *nft_table_lookup(const struct net *net,
 
 static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
                                                   const struct nlattr *nla,
-                                                  u8 genmask)
+                                                  u8 genmask, u32 nlpid)
 {
        struct nft_table *table;
 
        list_for_each_entry(table, &net->nft.tables, list) {
                if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
-                   nft_active_genmask(table, genmask))
+                   nft_active_genmask(table, genmask)) {
+                       if (nft_table_has_owner(table) &&
+                           nlpid && table->nlpid != nlpid)
+                               return ERR_PTR(-EPERM);
+
                        return table;
+               }
        }
 
        return ERR_PTR(-ENOENT);
@@ -1213,7 +1218,8 @@ static int nf_tables_deltable(struct net *net, struct sock *nlsk,
 
        if (nla[NFTA_TABLE_HANDLE]) {
                attr = nla[NFTA_TABLE_HANDLE];
-               table = nft_table_lookup_byhandle(net, attr, genmask);
+               table = nft_table_lookup_byhandle(net, attr, genmask,
+                                                 NETLINK_CB(skb).portid);
        } else {
                attr = nla[NFTA_TABLE_NAME];
                table = nft_table_lookup(net, attr, family, genmask,