This is a note to let you know that I've just added the patch titled
netfilter: nf_tables: reject unbound anonymous set before commit phase
to the 5.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nf_tables-reject-unbound-anonymous-set-before-commit-phase.patch
and it can be found in the queue-5.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From stable-owner@xxxxxxxxxxxxxxx Wed Jul 5 18:54:56 2023
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date: Wed, 5 Jul 2023 18:54:21 +0200
Subject: netfilter: nf_tables: reject unbound anonymous set before commit phase
To: netfilter-devel@xxxxxxxxxxxxxxx
Cc: sashal@xxxxxxxxxx, gregkh@xxxxxxxxxxxxxxxxxxx, stable@xxxxxxxxxxxxxxx
Message-ID: <20230705165423.50054-9-pablo@xxxxxxxxxxxxx>
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
[ 938154b93be8cd611ddfd7bafc1849f3c4355201 ]
Add a new list to track set transaction and to check for unbound
anonymous sets before entering the commit phase.
Bail out at the end of the transaction handling if an anonymous set
remains unbound.
Fixes: 96518518cc41 ("netfilter: add nftables")
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
include/net/netfilter/nf_tables.h | 3 +++
net/netfilter/nf_tables_api.c | 36 +++++++++++++++++++++++++++++++-----
2 files changed, 34 insertions(+), 5 deletions(-)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1364,6 +1364,7 @@ static inline void nft_set_elem_clear_bu
* struct nft_trans - nf_tables object update in transaction
*
* @list: used internally
+ * @binding_list: list of objects with possible bindings
* @msg_type: message type
* @put_net: ctx->net needs to be put
* @ctx: transaction context
@@ -1371,6 +1372,7 @@ static inline void nft_set_elem_clear_bu
*/
struct nft_trans {
struct list_head list;
+ struct list_head binding_list;
int msg_type;
bool put_net;
struct nft_ctx ctx;
@@ -1476,6 +1478,7 @@ __be64 nf_jiffies64_to_msecs(u64 input);
struct nftables_pernet {
struct list_head tables;
struct list_head commit_list;
+ struct list_head binding_list;
struct list_head module_list;
struct list_head notify_list;
struct mutex commit_mutex;
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -119,6 +119,7 @@ static struct nft_trans *nft_trans_alloc
return NULL;
INIT_LIST_HEAD(&trans->list);
+ INIT_LIST_HEAD(&trans->binding_list);
trans->msg_type = msg_type;
trans->ctx = *ctx;
@@ -131,9 +132,15 @@ static struct nft_trans *nft_trans_alloc
return nft_trans_alloc_gfp(ctx, msg_type, size, GFP_KERNEL);
}
-static void nft_trans_destroy(struct nft_trans *trans)
+static void nft_trans_list_del(struct nft_trans *trans)
{
list_del(&trans->list);
+ list_del(&trans->binding_list);
+}
+
+static void nft_trans_destroy(struct nft_trans *trans)
+{
+ nft_trans_list_del(trans);
kfree(trans);
}
@@ -174,9 +181,15 @@ static void nft_set_trans_unbind(const s
static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *trans)
{
- struct nftables_pernet *nft_net;
+ struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);
+
+ switch (trans->msg_type) {
+ case NFT_MSG_NEWSET:
+ if (nft_set_is_anonymous(nft_trans_set(trans)))
+ list_add_tail(&trans->binding_list, &nft_net->binding_list);
+ break;
+ }
- nft_net = net_generic(net, nf_tables_net_id);
list_add_tail(&trans->list, &nft_net->commit_list);
}
@@ -6697,7 +6710,7 @@ static void nf_tables_trans_destroy_work
synchronize_rcu();
list_for_each_entry_safe(trans, next, &head, list) {
- list_del(&trans->list);
+ nft_trans_list_del(trans);
nft_commit_release(trans);
}
}
@@ -6901,6 +6914,18 @@ static int nf_tables_commit(struct net *
return 0;
}
+ list_for_each_entry(trans, &nft_net->binding_list, binding_list) {
+ switch (trans->msg_type) {
+ case NFT_MSG_NEWSET:
+ if (nft_set_is_anonymous(nft_trans_set(trans)) &&
+ !nft_trans_set_bound(trans)) {
+ pr_warn_once("nftables ruleset with unbound set\n");
+ return -EINVAL;
+ }
+ break;
+ }
+ }
+
/* 0. Validate ruleset, otherwise roll back for error reporting. */
if (nf_tables_validate(net) < 0)
return -EAGAIN;
@@ -7249,7 +7274,7 @@ static int __nf_tables_abort(struct net
list_for_each_entry_safe_reverse(trans, next,
&nft_net->commit_list, list) {
- list_del(&trans->list);
+ nft_trans_list_del(trans);
nf_tables_abort_release(trans);
}
@@ -7914,6 +7939,7 @@ static int __net_init nf_tables_init_net
INIT_LIST_HEAD(&nft_net->tables);
INIT_LIST_HEAD(&nft_net->commit_list);
+ INIT_LIST_HEAD(&nft_net->binding_list);
INIT_LIST_HEAD(&nft_net->module_list);
INIT_LIST_HEAD(&nft_net->notify_list);
mutex_init(&nft_net->commit_mutex);
Patches currently in stable-queue which might be from stable-owner@xxxxxxxxxxxxxxx are
queue-5.4/netfilter-nf_tables-fix-scheduling-while-atomic-splat.patch
queue-5.4/netfilter-nf_tables-reject-unbound-anonymous-set-before-commit-phase.patch
queue-5.4/netfilter-nf_tables-use-net_generic-infra-for-transaction-data.patch
queue-5.4/netfilter-nf_tables-fix-nat-hook-table-deletion.patch
queue-5.4/netfilter-nf_tables-incorrect-error-path-handling-with-nft_msg_newrule.patch
queue-5.4/netfilter-nftables-add-helper-function-to-set-the-base-sequence-number.patch
queue-5.4/netfilter-nf_tables-add-rescheduling-points-during-loop-detection-walks.patch
queue-5.4/netfilter-nf_tables-add-nft_trans_prepare_error-to-deal-with-bound-set-chain.patch
queue-5.4/netfilter-add-helper-function-to-set-up-the-nfnetlink-header-and-use-it.patch
queue-5.4/netfilter-nf_tables-unbind-non-anonymous-set-if-rule-construction-fails.patch
