git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From stable-owner@vger.kernel.org Wed Jul  5 18:57:02 2023
   2 From: Pablo Neira Ayuso <pablo@netfilter.org>
   3 Date: Wed,  5 Jul 2023 18:56:22 +0200
   4 Subject: netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
   5 To: netfilter-devel@vger.kernel.org
   6 Cc: sashal@kernel.org, gregkh@linuxfoundation.org, stable@vger.kernel.org
   7 Message-ID: <20230705165623.50304-3-pablo@netfilter.org>
   8
   9 From: Pablo Neira Ayuso <pablo@netfilter.org>
  10
  11 [ 26b5a5712eb85e253724e56a54c17f8519bd8e4e ]
  12
  13 Add a new state to deal with rule expressions deactivation from the
  14 newrule error path, otherwise the anonymous set remains in the list in
  15 inactive state for the next generation. Mark the set/chain transaction
  16 as unbound so the abort path releases this object, set it as inactive in
  17 the next generation so it is not reachable anymore from this transaction
  18 and reference counter is dropped.
  19
  20 Fixes: 1240eb93f061 ("netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE")
  21 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  22 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  23 ---
  24  include/net/netfilter/nf_tables.h |    1 +
  25  net/netfilter/nf_tables_api.c     |   26 ++++++++++++++++++++++----
  26  2 files changed, 23 insertions(+), 4 deletions(-)
  27
  28 --- a/include/net/netfilter/nf_tables.h
  29 +++ b/include/net/netfilter/nf_tables.h
  30 @@ -725,6 +725,7 @@ struct nft_expr_type {
  31
  32  enum nft_trans_phase {
  33         NFT_TRANS_PREPARE,
  34 +       NFT_TRANS_PREPARE_ERROR,
  35         NFT_TRANS_ABORT,
  36         NFT_TRANS_COMMIT,
  37         NFT_TRANS_RELEASE
  38 --- a/net/netfilter/nf_tables_api.c
  39 +++ b/net/netfilter/nf_tables_api.c
  40 @@ -140,7 +140,8 @@ static void nft_trans_destroy(struct nft
  41         kfree(trans);
  42  }
  43
  44 -static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
  45 +static void __nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set,
  46 +                                bool bind)
  47  {
  48         struct net *net = ctx->net;
  49         struct nft_trans *trans;
  50 @@ -152,16 +153,26 @@ static void nft_set_trans_bind(const str
  51                 switch (trans->msg_type) {
  52                 case NFT_MSG_NEWSET:
  53                         if (nft_trans_set(trans) == set)
  54 -                               nft_trans_set_bound(trans) = true;
  55 +                               nft_trans_set_bound(trans) = bind;
  56                         break;
  57                 case NFT_MSG_NEWSETELEM:
  58                         if (nft_trans_elem_set(trans) == set)
  59 -                               nft_trans_elem_set_bound(trans) = true;
  60 +                               nft_trans_elem_set_bound(trans) = bind;
  61                         break;
  62                 }
  63         }
  64  }
  65
  66 +static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set)
  67 +{
  68 +       return __nft_set_trans_bind(ctx, set, true);
  69 +}
  70 +
  71 +static void nft_set_trans_unbind(const struct nft_ctx *ctx, struct nft_set *set)
  72 +{
  73 +       return __nft_set_trans_bind(ctx, set, false);
  74 +}
  75 +
  76  static int nf_tables_register_hooks(struct net *net,
  77                                     const struct nft_table *table,
  78                                     struct nft_chain *chain,
  79 @@ -2465,7 +2476,7 @@ static int nf_tables_newrule(struct net
  80         return 0;
  81
  82  err2:
  83 -       nft_rule_expr_deactivate(&ctx, rule, NFT_TRANS_PREPARE);
  84 +       nft_rule_expr_deactivate(&ctx, rule, NFT_TRANS_PREPARE_ERROR);
  85         nf_tables_rule_destroy(&ctx, rule);
  86  err1:
  87         for (i = 0; i < n; i++) {
  88 @@ -3446,6 +3457,13 @@ void nf_tables_deactivate_set(const stru
  89                               enum nft_trans_phase phase)
  90  {
  91         switch (phase) {
  92 +       case NFT_TRANS_PREPARE_ERROR:
  93 +               nft_set_trans_unbind(ctx, set);
  94 +               if (set->flags & NFT_SET_ANONYMOUS)
  95 +                       nft_deactivate_next(ctx->net, set);
  96 +
  97 +               set->use--;
  98 +               break;
  99         case NFT_TRANS_PREPARE:
 100                 if (set->flags & NFT_SET_ANONYMOUS)
 101                         nft_deactivate_next(ctx->net, set);