[PATCH] netfilter: nf_tables: fix oops when deleting a chain with references

[PATCH] netfilter: nf_tables: fix oops when deleting a chain with references

[Patrick McHardy]

commit 780f57420cdac84eabec388868678ede19f7d682
Author: Patrick McHardy <kaber@trash.net>
Date:   Fri Jan 24 13:23:52 2014 +0000

    netfilter: nf_tables: fix oops when deleting a chain with references

    THe following commands trigger an oops:

    # nft -i
    nft> add table filter
    nft> add chain filter input { type filter hook input priority 0; }
    nft> add chain filter test 
    nft> add rule filter input jump test
    nft> delete chain filter test
    
    We need to check the chain use counter before allowing destruction since
    we might have references from sets or jump rules.
    
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=69341
    Reported-by: Matthew Ife <deleriux1@gmail.com>
    Tested-by: Matthew Ife <deleriux1@gmail.com>
    Signed-off-by: Patrick McHardy <kaber@trash.net>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 117bbaa..9ce3053 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1045,7 +1045,7 @@ static int nf_tables_delchain(struct sock *nlsk, struct sk_buff *skb,
 	if (IS_ERR(chain))
 		return PTR_ERR(chain);
 
-	if (!list_empty(&chain->rules))
+	if (!list_empty(&chain->rules) || chain->use > 0)
 		return -EBUSY;
 
 	list_del(&chain->list);

Re: [PATCH] netfilter: nf_tables: fix oops when deleting a chain with references

[Pablo Neira Ayuso]

On Sat, Jan 25, 2014 at 08:04:07AM +0000, Patrick McHardy wrote:
> commit 780f57420cdac84eabec388868678ede19f7d682
> Author: Patrick McHardy <kaber@trash.net>
> Date:   Fri Jan 24 13:23:52 2014 +0000
> 
>     netfilter: nf_tables: fix oops when deleting a chain with references
> 
>     THe following commands trigger an oops:
> 
>     # nft -i
>     nft> add table filter
>     nft> add chain filter input { type filter hook input priority 0; }
>     nft> add chain filter test 
>     nft> add rule filter input jump test
>     nft> delete chain filter test
>     
>     We need to check the chain use counter before allowing destruction since
>     we might have references from sets or jump rules.

Applied, thanks Patrick.