From: Pablo Neira Ayuso Date: Thu, 21 Mar 2024 00:27:50 +0000 (+0100) Subject: netfilter: nf_tables: reject destroy command to remove basechain hooks X-Git-Tag: v6.8.5~236 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0597e0dc5080ef6eae05f5b81632b39baf1217be;p=thirdparty%2Fkernel%2Fstable.git netfilter: nf_tables: reject destroy command to remove basechain hooks [ Upstream commit b32ca27fa238ff83427d23bef2a5b741e2a88a1e ] Report EOPNOTSUPP if NFT_MSG_DESTROYCHAIN is used to delete hooks in an existing netdev basechain, thus, only NFT_MSG_DELCHAIN is allowed. Fixes: 7d937b107108f ("netfilter: nf_tables: support for deleting devices in an existing netdev chain") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index ec6266c1972c0..00288b31f734c 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2932,7 +2932,8 @@ static int nf_tables_delchain(struct sk_buff *skb, const struct nfnl_info *info, nft_ctx_init(&ctx, net, skb, info->nlh, family, table, chain, nla); if (nla[NFTA_CHAIN_HOOK]) { - if (chain->flags & NFT_CHAIN_HW_OFFLOAD) + if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYCHAIN || + chain->flags & NFT_CHAIN_HW_OFFLOAD) return -EOPNOTSUPP; if (nft_is_base_chain(chain)) {