Fixes for 5.10

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-5.10/netfilter-nf_tables-disallow-rule-removal-from-chain.patch b/queue-5.10/netfilter-nf_tables-disallow-rule-removal-from-chain.patch
new file mode 100644 (file)
index 0000000..948f7db
--- /dev/null
+++ b/queue-5.10/netfilter-nf_tables-disallow-rule-removal-from-chain.patch
@@ -0,0 +1,102 @@
+From f5777234b25166d0092438e7fbbd65526aa12f06 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Sep 2023 08:22:33 +0200
+Subject: netfilter: nf_tables: disallow rule removal from chain binding
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit f15f29fd4779be8a418b66e9d52979bb6d6c2325 ]
+
+Chain binding only requires the rule addition/insertion command within
+the same transaction. Removal of rules from chain bindings within the
+same transaction makes no sense, userspace does not utilize this
+feature. Replace nft_chain_is_bound() check to nft_chain_binding() in
+rule deletion commands. Replace command implies a rule deletion, reject
+this command too.
+
+Rule flush command can also safely rely on this nft_chain_binding()
+check because unbound chains are not allowed since 62e1e94b246e
+("netfilter: nf_tables: reject unbound chain set before commit phase").
+
+Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
+Reported-by: Kevin Rich <kevinrich1337@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 16e2500e8590b..78b268bd7f012 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1268,7 +1268,7 @@ static int nft_flush_table(struct nft_ctx *ctx)
+               if (!nft_is_active_next(ctx->net, chain))
+                       continue;
+ 
+-              if (nft_chain_is_bound(chain))
++              if (nft_chain_binding(chain))
+                       continue;
+ 
+               ctx->chain = chain;
+@@ -1312,7 +1312,7 @@ static int nft_flush_table(struct nft_ctx *ctx)
+               if (!nft_is_active_next(ctx->net, chain))
+                       continue;
+ 
+-              if (nft_chain_is_bound(chain))
++              if (nft_chain_binding(chain))
+                       continue;
+ 
+               ctx->chain = chain;
+@@ -2599,6 +2599,9 @@ static int nf_tables_delchain(struct net *net, struct sock *nlsk,
+               return PTR_ERR(chain);
+       }
+ 
++      if (nft_chain_binding(chain))
++              return -EOPNOTSUPP;
++
+       if (nlh->nlmsg_flags & NLM_F_NONREC &&
+           chain->use > 0)
+               return -EBUSY;
+@@ -3498,6 +3501,11 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
+       }
+ 
+       if (nlh->nlmsg_flags & NLM_F_REPLACE) {
++              if (nft_chain_binding(chain)) {
++                      err = -EOPNOTSUPP;
++                      goto err_destroy_flow_rule;
++              }
++
+               trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule);
+               if (trans == NULL) {
+                       err = -ENOMEM;
+@@ -3606,7 +3614,7 @@ static int nf_tables_delrule(struct net *net, struct sock *nlsk,
+                       NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
+                       return PTR_ERR(chain);
+               }
+-              if (nft_chain_is_bound(chain))
++              if (nft_chain_binding(chain))
+                       return -EOPNOTSUPP;
+       }
+ 
+@@ -3636,7 +3644,7 @@ static int nf_tables_delrule(struct net *net, struct sock *nlsk,
+               list_for_each_entry(chain, &table->chains, list) {
+                       if (!nft_is_active_next(net, chain))
+                               continue;
+-                      if (nft_chain_is_bound(chain))
++                      if (nft_chain_binding(chain))
+                               continue;
+ 
+                       ctx.chain = chain;
+@@ -9529,7 +9537,7 @@ static void __nft_release_table(struct net *net, struct nft_table *table)
+       ctx.family = table->family;
+       ctx.table = table;
+       list_for_each_entry(chain, &table->chains, list) {
+-              if (nft_chain_is_bound(chain))
++              if (nft_chain_binding(chain))
+                       continue;
+ 
+               ctx.chain = chain;
+-- 
+2.40.1
+

diff --git a/queue-5.10/series b/queue-5.10/series
index b7e158ab6be86441e29cd54a2297ccc9e3918700..4df33bb981d6275141ca02c9377376911a4b6cac 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -146,3 +146,4 @@ nvme-pci-always-return-an-err_ptr-from-nvme_pci_allo.patch
 smack-record-transmuting-in-smk_transmuted.patch
 smack-retrieve-transmuting-information-in-smack_inod.patch
 smack-use-overlay-inode-label-in-smack_inode_copy_up.patch
+netfilter-nf_tables-disallow-rule-removal-from-chain.patch