From b5f5e959d517c20daf7eb35aba2a4ebce7ce6fd4 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Wed, 4 Oct 2023 10:10:58 -0400 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- ...les-disallow-rule-removal-from-chain.patch | 102 ++++++++++++++++++ queue-5.10/series | 1 + 2 files changed, 103 insertions(+) create mode 100644 queue-5.10/netfilter-nf_tables-disallow-rule-removal-from-chain.patch diff --git a/queue-5.10/netfilter-nf_tables-disallow-rule-removal-from-chain.patch b/queue-5.10/netfilter-nf_tables-disallow-rule-removal-from-chain.patch new file mode 100644 index 00000000000..948f7db201f --- /dev/null +++ b/queue-5.10/netfilter-nf_tables-disallow-rule-removal-from-chain.patch @@ -0,0 +1,102 @@ +From f5777234b25166d0092438e7fbbd65526aa12f06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Sep 2023 08:22:33 +0200 +Subject: netfilter: nf_tables: disallow rule removal from chain binding + +From: Pablo Neira Ayuso + +[ Upstream commit f15f29fd4779be8a418b66e9d52979bb6d6c2325 ] + +Chain binding only requires the rule addition/insertion command within +the same transaction. Removal of rules from chain bindings within the +same transaction makes no sense, userspace does not utilize this +feature. Replace nft_chain_is_bound() check to nft_chain_binding() in +rule deletion commands. Replace command implies a rule deletion, reject +this command too. + +Rule flush command can also safely rely on this nft_chain_binding() +check because unbound chains are not allowed since 62e1e94b246e +("netfilter: nf_tables: reject unbound chain set before commit phase"). + +Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") +Reported-by: Kevin Rich +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 16e2500e8590b..78b268bd7f012 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -1268,7 +1268,7 @@ static int nft_flush_table(struct nft_ctx *ctx) + if (!nft_is_active_next(ctx->net, chain)) + continue; + +- if (nft_chain_is_bound(chain)) ++ if (nft_chain_binding(chain)) + continue; + + ctx->chain = chain; +@@ -1312,7 +1312,7 @@ static int nft_flush_table(struct nft_ctx *ctx) + if (!nft_is_active_next(ctx->net, chain)) + continue; + +- if (nft_chain_is_bound(chain)) ++ if (nft_chain_binding(chain)) + continue; + + ctx->chain = chain; +@@ -2599,6 +2599,9 @@ static int nf_tables_delchain(struct net *net, struct sock *nlsk, + return PTR_ERR(chain); + } + ++ if (nft_chain_binding(chain)) ++ return -EOPNOTSUPP; ++ + if (nlh->nlmsg_flags & NLM_F_NONREC && + chain->use > 0) + return -EBUSY; +@@ -3498,6 +3501,11 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, + } + + if (nlh->nlmsg_flags & NLM_F_REPLACE) { ++ if (nft_chain_binding(chain)) { ++ err = -EOPNOTSUPP; ++ goto err_destroy_flow_rule; ++ } ++ + trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule); + if (trans == NULL) { + err = -ENOMEM; +@@ -3606,7 +3614,7 @@ static int nf_tables_delrule(struct net *net, struct sock *nlsk, + NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); + return PTR_ERR(chain); + } +- if (nft_chain_is_bound(chain)) ++ if (nft_chain_binding(chain)) + return -EOPNOTSUPP; + } + +@@ -3636,7 +3644,7 @@ static int nf_tables_delrule(struct net *net, struct sock *nlsk, + list_for_each_entry(chain, &table->chains, list) { + if (!nft_is_active_next(net, chain)) + continue; +- if (nft_chain_is_bound(chain)) ++ if (nft_chain_binding(chain)) + continue; + + ctx.chain = chain; +@@ -9529,7 +9537,7 @@ static void __nft_release_table(struct net *net, struct nft_table *table) + ctx.family = table->family; + ctx.table = table; + list_for_each_entry(chain, &table->chains, list) { +- if (nft_chain_is_bound(chain)) ++ if (nft_chain_binding(chain)) + continue; + + ctx.chain = chain; +-- +2.40.1 + diff --git a/queue-5.10/series b/queue-5.10/series index b7e158ab6be..4df33bb981d 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -146,3 +146,4 @@ nvme-pci-always-return-an-err_ptr-from-nvme_pci_allo.patch smack-record-transmuting-in-smk_transmuted.patch smack-retrieve-transmuting-information-in-smack_inod.patch smack-use-overlay-inode-label-in-smack_inode_copy_up.patch +netfilter-nf_tables-disallow-rule-removal-from-chain.patch -- 2.47.3