From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 553E1C8E5 for ; Mon, 26 Jun 2023 18:42:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C1B7DC433C8; Mon, 26 Jun 2023 18:42:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1687804975; bh=xGMEyqdOK8Qw+ogWp0OJRqSk1b+ICeJeJkoJ5c4okl0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uwQdwvG4+B+hpvgMNly+lVoMgS+HJ72u24u0Hto4XwB8n5JDxbUOMCEhBPmuBPsuH YzrmWDeIZAqTNMtaQwZunnb+FWht9IbjoHMlNz0SIMIlOGXSWXCAwBaqcSxv1+cKIB 3wPTv6j8kPNjhCFTwtD/UUx3z2UcoM9gPBz/9tw0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 5.15 66/96] netfilter: nf_tables: reject unbound chain set before commit phase Date: Mon, 26 Jun 2023 20:12:21 +0200 Message-ID: <20230626180749.693613693@linuxfoundation.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20230626180746.943455203@linuxfoundation.org> References: <20230626180746.943455203@linuxfoundation.org> User-Agent: quilt/0.67 Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Pablo Neira Ayuso [ Upstream commit 62e1e94b246e685d89c3163aaef4b160e42ceb02 ] Use binding list to track set transaction and to check for unbound chains before entering the commit phase. Bail out if chain binding remain unused before entering the commit step. Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/netfilter/nf_tables_api.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 010ef3bce9e5f..66328326ec05e 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -372,6 +372,11 @@ static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *tr nft_set_is_anonymous(nft_trans_set(trans))) list_add_tail(&trans->binding_list, &nft_net->binding_list); break; + case NFT_MSG_NEWCHAIN: + if (!nft_trans_chain_update(trans) && + nft_chain_binding(nft_trans_chain(trans))) + list_add_tail(&trans->binding_list, &nft_net->binding_list); + break; } list_add_tail(&trans->list, &nft_net->commit_list); @@ -8908,6 +8913,14 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) return -EINVAL; } break; + case NFT_MSG_NEWCHAIN: + if (!nft_trans_chain_update(trans) && + nft_chain_binding(nft_trans_chain(trans)) && + !nft_trans_chain_bound(trans)) { + pr_warn_once("nftables ruleset with unbound chain\n"); + return -EINVAL; + } + break; } } -- 2.39.2