From: Pablo Neira Ayuso Date: Thu, 21 Mar 2024 00:27:50 +0000 (+0100) Subject: netfilter: nf_tables: reject destroy command to remove basechain hooks X-Git-Tag: v6.6.26~221 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cddd0480a682426d44fdadb55354367a905cedb7;p=thirdparty%2Fkernel%2Fstable.git netfilter: nf_tables: reject destroy command to remove basechain hooks [ Upstream commit b32ca27fa238ff83427d23bef2a5b741e2a88a1e ] Report EOPNOTSUPP if NFT_MSG_DESTROYCHAIN is used to delete hooks in an existing netdev basechain, thus, only NFT_MSG_DELCHAIN is allowed. Fixes: 7d937b107108f ("netfilter: nf_tables: support for deleting devices in an existing netdev chain") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index f10419ba6e0bd..0653f1e5e8929 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2934,7 +2934,8 @@ static int nf_tables_delchain(struct sk_buff *skb, const struct nfnl_info *info, nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); if (nla[NFTA_CHAIN_HOOK]) { - if (chain->flags & NFT_CHAIN_HW_OFFLOAD) + if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYCHAIN || + chain->flags & NFT_CHAIN_HW_OFFLOAD) return -EOPNOTSUPP; if (nft_is_base_chain(chain)) {