From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4CB8D2DF73; Mon, 8 Apr 2024 13:20:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712582454; cv=none; b=cx1u6jtkaMv/2scavMwmVPkaFCeq+YHiOHRrtpU9U1pKzJ27NgOiACRrZH1tBQK3xWtwCSKInT9QI/cgjEdiGkm++VvWQHRHUTPLdA/T40P7WaQt3xn++gS8CYqWLpdo9HMCiJ7M18zzDq+P3E5o3UsNSqpTKYlc7w6i2SnYG5Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1712582454; c=relaxed/simple; bh=S2OMhON8lkV04L2UiCZtO3BB+a2keVDyX6PQiUfRJFQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=JGSoglJrXZo34Ft2wkg541mPIJ2xI2PwCcsZ5vjn6yuqa9yQEEEJkP+3PIph/ilchI/j8aJsmOT4DdW+foO8SRsPCaLclXMC2n+zyOH8gqGhJACbcVZlarImNe6zGAf8CRMD6Evf9P0BO4vYWfFxUXA+J+6Y3zSkkfkDLrEdd9g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Fs04fZW0; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Fs04fZW0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C77E3C433C7; Mon, 8 Apr 2024 13:20:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1712582454; bh=S2OMhON8lkV04L2UiCZtO3BB+a2keVDyX6PQiUfRJFQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Fs04fZW0QJu+9EnfXXGDx3WeBEwzy+ebCYHL82BilA2s1Gij4e4ptNvaSNMqP0Skh ZY7fDPpK6I9eqCL8xmIq4chOXSHC7EOo+f0mORvx1QnlmVn3Q0NVpgQRG1ChBLiTF1 Ki0vRtEQBA0Mf8zBOKs+H2qDZ3+LgsLY9UAW23aI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Pablo Neira Ayuso Subject: [PATCH 6.6 094/252] netfilter: nf_tables: reject new basechain after table flag update Date: Mon, 8 Apr 2024 14:56:33 +0200 Message-ID: <20240408125309.572599815@linuxfoundation.org> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240408125306.643546457@linuxfoundation.org> References: <20240408125306.643546457@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Pablo Neira Ayuso commit 994209ddf4f430946f6247616b2e33d179243769 upstream. When dormant flag is toggled, hooks are disabled in the commit phase by iterating over current chains in table (existing and new). The following configuration allows for an inconsistent state: add table x add chain x y { type filter hook input priority 0; } add table x { flags dormant; } add chain x w { type filter hook input priority 1; } which triggers the following warning when trying to unregister chain w which is already unregistered. [ 127.322252] WARNING: CPU: 7 PID: 1211 at net/netfilter/core.c:50 1 __nf_unregister_net_hook+0x21a/0x260 [...] [ 127.322519] Call Trace: [ 127.322521] [ 127.322524] ? __warn+0x9f/0x1a0 [ 127.322531] ? __nf_unregister_net_hook+0x21a/0x260 [ 127.322537] ? report_bug+0x1b1/0x1e0 [ 127.322545] ? handle_bug+0x3c/0x70 [ 127.322552] ? exc_invalid_op+0x17/0x40 [ 127.322556] ? asm_exc_invalid_op+0x1a/0x20 [ 127.322563] ? kasan_save_free_info+0x3b/0x60 [ 127.322570] ? __nf_unregister_net_hook+0x6a/0x260 [ 127.322577] ? __nf_unregister_net_hook+0x21a/0x260 [ 127.322583] ? __nf_unregister_net_hook+0x6a/0x260 [ 127.322590] ? __nf_tables_unregister_hook+0x8a/0xe0 [nf_tables] [ 127.322655] nft_table_disable+0x75/0xf0 [nf_tables] [ 127.322717] nf_tables_commit+0x2571/0x2620 [nf_tables] Fixes: 179d9ba5559a ("netfilter: nf_tables: fix table flag updates") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman --- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+) --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2439,6 +2439,9 @@ static int nf_tables_addchain(struct nft struct nft_stats __percpu *stats = NULL; struct nft_chain_hook hook = {}; + if (table->flags & __NFT_TABLE_F_UPDATE) + return -EINVAL; + if (flags & NFT_CHAIN_BINDING) return -EOPNOTSUPP;