Skip to content

Commit 9e08dce

Browse files
davem330davem330
committed
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Pablo Neir Ayuso says: ==================== The following patchset contains Netfilter fixes for net: 1) Hit ENOENT when trying to update an unexisting base chain. 2) Fix libmnl pkg-config usage in selftests, from Jeremy Sowden. 3) KASAN reports use-after-free when deleting a set element for an anonymous set that was already removed in the same transaction, reported by P. Sondej and P. Krysiuk. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2 parents c6d96df + c1592a8 commit 9e08dce

6 files changed

Lines changed: 38 additions & 17 deletions

File tree

‎include/net/netfilter/nf_tables.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -619,6 +619,7 @@ struct nft_set_binding {
619619
};
620620

621621
enum nft_trans_phase;
622+
void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set);
622623
void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
623624
struct nft_set_binding *binding,
624625
enum nft_trans_phase phase);

‎net/netfilter/nf_tables_api.c‎

Lines changed: 29 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2075,8 +2075,10 @@ static int nft_chain_parse_hook(struct net *net,
20752075

20762076
if (!basechain) {
20772077
if (!ha[NFTA_HOOK_HOOKNUM] ||
2078-
!ha[NFTA_HOOK_PRIORITY])
2079-
return -EINVAL;
2078+
!ha[NFTA_HOOK_PRIORITY]) {
2079+
NL_SET_BAD_ATTR(extack, nla[NFTA_CHAIN_NAME]);
2080+
return -ENOENT;
2081+
}
20802082

20812083
hook->num = ntohl(nla_get_be32(ha[NFTA_HOOK_HOOKNUM]));
20822084
hook->priority = ntohl(nla_get_be32(ha[NFTA_HOOK_PRIORITY]));
@@ -5125,12 +5127,24 @@ static void nf_tables_unbind_set(const struct nft_ctx *ctx, struct nft_set *set,
51255127
}
51265128
}
51275129

5130+
void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set)
5131+
{
5132+
if (nft_set_is_anonymous(set))
5133+
nft_clear(ctx->net, set);
5134+
5135+
set->use++;
5136+
}
5137+
EXPORT_SYMBOL_GPL(nf_tables_activate_set);
5138+
51285139
void nf_tables_deactivate_set(const struct nft_ctx *ctx, struct nft_set *set,
51295140
struct nft_set_binding *binding,
51305141
enum nft_trans_phase phase)
51315142
{
51325143
switch (phase) {
51335144
case NFT_TRANS_PREPARE:
5145+
if (nft_set_is_anonymous(set))
5146+
nft_deactivate_next(ctx->net, set);
5147+
51345148
set->use--;
51355149
return;
51365150
case NFT_TRANS_ABORT:
@@ -7693,7 +7707,7 @@ static const struct nla_policy nft_flowtable_hook_policy[NFTA_FLOWTABLE_HOOK_MAX
76937707
};
76947708

76957709
static int nft_flowtable_parse_hook(const struct nft_ctx *ctx,
7696-
const struct nlattr *attr,
7710+
const struct nlattr * const nla[],
76977711
struct nft_flowtable_hook *flowtable_hook,
76987712
struct nft_flowtable *flowtable,
76997713
struct netlink_ext_ack *extack, bool add)
@@ -7705,15 +7719,18 @@ static int nft_flowtable_parse_hook(const struct nft_ctx *ctx,
77057719

77067720
INIT_LIST_HEAD(&flowtable_hook->list);
77077721

7708-
err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX, attr,
7722+
err = nla_parse_nested_deprecated(tb, NFTA_FLOWTABLE_HOOK_MAX,
7723+
nla[NFTA_FLOWTABLE_HOOK],
77097724
nft_flowtable_hook_policy, NULL);
77107725
if (err < 0)
77117726
return err;
77127727

77137728
if (add) {
77147729
if (!tb[NFTA_FLOWTABLE_HOOK_NUM] ||
7715-
!tb[NFTA_FLOWTABLE_HOOK_PRIORITY])
7716-
return -EINVAL;
7730+
!tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) {
7731+
NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);
7732+
return -ENOENT;
7733+
}
77177734

77187735
hooknum = ntohl(nla_get_be32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
77197736
if (hooknum != NF_NETDEV_INGRESS)
@@ -7898,8 +7915,8 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
78987915
u32 flags;
78997916
int err;
79007917

7901-
err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
7902-
&flowtable_hook, flowtable, extack, false);
7918+
err = nft_flowtable_parse_hook(ctx, nla, &flowtable_hook, flowtable,
7919+
extack, false);
79037920
if (err < 0)
79047921
return err;
79057922

@@ -8044,8 +8061,8 @@ static int nf_tables_newflowtable(struct sk_buff *skb,
80448061
if (err < 0)
80458062
goto err3;
80468063

8047-
err = nft_flowtable_parse_hook(&ctx, nla[NFTA_FLOWTABLE_HOOK],
8048-
&flowtable_hook, flowtable, extack, true);
8064+
err = nft_flowtable_parse_hook(&ctx, nla, &flowtable_hook, flowtable,
8065+
extack, true);
80498066
if (err < 0)
80508067
goto err4;
80518068

@@ -8107,8 +8124,8 @@ static int nft_delflowtable_hook(struct nft_ctx *ctx,
81078124
struct nft_trans *trans;
81088125
int err;
81098126

8110-
err = nft_flowtable_parse_hook(ctx, nla[NFTA_FLOWTABLE_HOOK],
8111-
&flowtable_hook, flowtable, extack, false);
8127+
err = nft_flowtable_parse_hook(ctx, nla, &flowtable_hook, flowtable,
8128+
extack, false);
81128129
if (err < 0)
81138130
return err;
81148131

‎net/netfilter/nft_dynset.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -342,7 +342,7 @@ static void nft_dynset_activate(const struct nft_ctx *ctx,
342342
{
343343
struct nft_dynset *priv = nft_expr_priv(expr);
344344

345-
priv->set->use++;
345+
nf_tables_activate_set(ctx, priv->set);
346346
}
347347

348348
static void nft_dynset_destroy(const struct nft_ctx *ctx,

‎net/netfilter/nft_lookup.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,7 @@ static void nft_lookup_activate(const struct nft_ctx *ctx,
167167
{
168168
struct nft_lookup *priv = nft_expr_priv(expr);
169169

170-
priv->set->use++;
170+
nf_tables_activate_set(ctx, priv->set);
171171
}
172172

173173
static void nft_lookup_destroy(const struct nft_ctx *ctx,

‎net/netfilter/nft_objref.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ static void nft_objref_map_activate(const struct nft_ctx *ctx,
185185
{
186186
struct nft_objref_map *priv = nft_expr_priv(expr);
187187

188-
priv->set->use++;
188+
nf_tables_activate_set(ctx, priv->set);
189189
}
190190

191191
static void nft_objref_map_destroy(const struct nft_ctx *ctx,

‎tools/testing/selftests/netfilter/Makefile‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,11 @@ TEST_PROGS := nft_trans_stress.sh nft_fib.sh nft_nat.sh bridge_brouter.sh \
88
ipip-conntrack-mtu.sh conntrack_tcp_unreplied.sh \
99
conntrack_vrf.sh nft_synproxy.sh rpath.sh
1010

11-
CFLAGS += $(shell pkg-config --cflags libmnl 2>/dev/null || echo "-I/usr/include/libmnl")
12-
LDLIBS = -lmnl
11+
HOSTPKG_CONFIG := pkg-config
12+
13+
CFLAGS += $(shell $(HOSTPKG_CONFIG) --cflags libmnl 2>/dev/null)
14+
LDLIBS += $(shell $(HOSTPKG_CONFIG) --libs libmnl 2>/dev/null || echo -lmnl)
15+
1316
TEST_GEN_FILES = nf-queue connect_close
1417

1518
include ../lib.mk

0 commit comments

Comments
 (0)