* [PATCH -stable,4.19.x] netfilter: nf_tables: validate family when identifying table via handle
@ 2024-06-27 0:41 Pablo Neira Ayuso
2024-06-27 0:41 ` [PATCH -stable,5.4.x] " Pablo Neira Ayuso
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2024-06-27 0:41 UTC (permalink / raw)
To: netfilter-devel; +Cc: stable, gregkh, sashal, torvalds
[ Upstream commit f6e1532a2697b81da00bfb184e99d15e01e9d98c ]
Validate table family when looking up for it via NFTA_TABLE_HANDLE.
Fixes: 3ecbfd65f50e ("netfilter: nf_tables: allocate handle and delete objects via handle")
Reported-by: Xingyuan Mo <hdthky0@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 198e4a89df48..2c31470dd61f 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -536,7 +536,7 @@ static struct nft_table *nft_table_lookup(const struct net *net,
static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
const struct nlattr *nla,
- u8 genmask)
+ int family, u8 genmask)
{
struct nftables_pernet *nft_net;
struct nft_table *table;
@@ -544,6 +544,7 @@ static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
nft_net = net_generic(net, nf_tables_net_id);
list_for_each_entry(table, &nft_net->tables, list) {
if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
+ table->family == family &&
nft_active_genmask(table, genmask))
return table;
}
@@ -1189,7 +1190,7 @@ static int nf_tables_deltable(struct net *net, struct sock *nlsk,
if (nla[NFTA_TABLE_HANDLE]) {
attr = nla[NFTA_TABLE_HANDLE];
- table = nft_table_lookup_byhandle(net, attr, genmask);
+ table = nft_table_lookup_byhandle(net, attr, family, genmask);
} else {
attr = nla[NFTA_TABLE_NAME];
table = nft_table_lookup(net, attr, family, genmask);
--
2.30.2
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH -stable,5.4.x] netfilter: nf_tables: validate family when identifying table via handle
2024-06-27 0:41 [PATCH -stable,4.19.x] netfilter: nf_tables: validate family when identifying table via handle Pablo Neira Ayuso
@ 2024-06-27 0:41 ` Pablo Neira Ayuso
2024-06-27 0:41 ` [PATCH -stable,5.10.x] " Pablo Neira Ayuso
2024-06-27 20:07 ` [PATCH -stable,4.19.x] " Sasha Levin
2 siblings, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2024-06-27 0:41 UTC (permalink / raw)
To: netfilter-devel; +Cc: stable, gregkh, sashal, torvalds
[ Upstream commit f6e1532a2697b81da00bfb184e99d15e01e9d98c ]
Validate table family when looking up for it via NFTA_TABLE_HANDLE.
Fixes: 3ecbfd65f50e ("netfilter: nf_tables: allocate handle and delete objects via handle")
Reported-by: Xingyuan Mo <hdthky0@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 8131d858f38d..44d4d97b45d1 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -553,7 +553,7 @@ static struct nft_table *nft_table_lookup(const struct net *net,
static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
const struct nlattr *nla,
- u8 genmask)
+ int family, u8 genmask)
{
struct nftables_pernet *nft_net;
struct nft_table *table;
@@ -561,6 +561,7 @@ static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
nft_net = net_generic(net, nf_tables_net_id);
list_for_each_entry(table, &nft_net->tables, list) {
if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
+ table->family == family &&
nft_active_genmask(table, genmask))
return table;
}
@@ -1243,7 +1244,7 @@ static int nf_tables_deltable(struct net *net, struct sock *nlsk,
if (nla[NFTA_TABLE_HANDLE]) {
attr = nla[NFTA_TABLE_HANDLE];
- table = nft_table_lookup_byhandle(net, attr, genmask);
+ table = nft_table_lookup_byhandle(net, attr, family, genmask);
} else {
attr = nla[NFTA_TABLE_NAME];
table = nft_table_lookup(net, attr, family, genmask);
--
2.30.2
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH -stable,5.10.x] netfilter: nf_tables: validate family when identifying table via handle
2024-06-27 0:41 [PATCH -stable,4.19.x] netfilter: nf_tables: validate family when identifying table via handle Pablo Neira Ayuso
2024-06-27 0:41 ` [PATCH -stable,5.4.x] " Pablo Neira Ayuso
@ 2024-06-27 0:41 ` Pablo Neira Ayuso
2024-06-27 20:07 ` [PATCH -stable,4.19.x] " Sasha Levin
2 siblings, 0 replies; 4+ messages in thread
From: Pablo Neira Ayuso @ 2024-06-27 0:41 UTC (permalink / raw)
To: netfilter-devel; +Cc: stable, gregkh, sashal, torvalds
[ Upstream commit f6e1532a2697b81da00bfb184e99d15e01e9d98c ]
Validate table family when looking up for it via NFTA_TABLE_HANDLE.
Fixes: 3ecbfd65f50e ("netfilter: nf_tables: allocate handle and delete objects via handle")
Reported-by: Xingyuan Mo <hdthky0@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index f3cb5c920276..754278b85706 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -713,7 +713,7 @@ static struct nft_table *nft_table_lookup(const struct net *net,
static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
const struct nlattr *nla,
- u8 genmask)
+ int family, u8 genmask)
{
struct nftables_pernet *nft_net;
struct nft_table *table;
@@ -721,6 +721,7 @@ static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
nft_net = net_generic(net, nf_tables_net_id);
list_for_each_entry(table, &nft_net->tables, list) {
if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
+ table->family == family &&
nft_active_genmask(table, genmask))
return table;
}
@@ -1440,7 +1441,7 @@ static int nf_tables_deltable(struct net *net, struct sock *nlsk,
if (nla[NFTA_TABLE_HANDLE]) {
attr = nla[NFTA_TABLE_HANDLE];
- table = nft_table_lookup_byhandle(net, attr, genmask);
+ table = nft_table_lookup_byhandle(net, attr, family, genmask);
} else {
attr = nla[NFTA_TABLE_NAME];
table = nft_table_lookup(net, attr, family, genmask);
--
2.30.2
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH -stable,4.19.x] netfilter: nf_tables: validate family when identifying table via handle
2024-06-27 0:41 [PATCH -stable,4.19.x] netfilter: nf_tables: validate family when identifying table via handle Pablo Neira Ayuso
2024-06-27 0:41 ` [PATCH -stable,5.4.x] " Pablo Neira Ayuso
2024-06-27 0:41 ` [PATCH -stable,5.10.x] " Pablo Neira Ayuso
@ 2024-06-27 20:07 ` Sasha Levin
2 siblings, 0 replies; 4+ messages in thread
From: Sasha Levin @ 2024-06-27 20:07 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel, stable, gregkh, torvalds
On Thu, Jun 27, 2024 at 02:41:11AM +0200, Pablo Neira Ayuso wrote:
>[ Upstream commit f6e1532a2697b81da00bfb184e99d15e01e9d98c ]
>
>Validate table family when looking up for it via NFTA_TABLE_HANDLE.
>
>Fixes: 3ecbfd65f50e ("netfilter: nf_tables: allocate handle and delete objects via handle")
>Reported-by: Xingyuan Mo <hdthky0@gmail.com>
>Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
>Signed-off-by: Sasha Levin <sashal@kernel.org>
Queued up, thanks!
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-06-27 20:07 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-06-27 0:41 [PATCH -stable,4.19.x] netfilter: nf_tables: validate family when identifying table via handle Pablo Neira Ayuso
2024-06-27 0:41 ` [PATCH -stable,5.4.x] " Pablo Neira Ayuso
2024-06-27 0:41 ` [PATCH -stable,5.10.x] " Pablo Neira Ayuso
2024-06-27 20:07 ` [PATCH -stable,4.19.x] " Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox