Commit 0ebc1064 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Florian Westphal
Browse files

netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID 



Bail out with EOPNOTSUPP when adding rule to bound chain via
NFTA_RULE_CHAIN_ID. The following warning splat is shown when
adding a rule to a deleted bound chain:

 WARNING: CPU: 2 PID: 13692 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]
 CPU: 2 PID: 13692 Comm: chain-bound-rul Not tainted 6.1.39 #1
 RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]

Fixes: d0e2c7de ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
Reported-by: default avatarKevin Rich <kevinrich1337@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
parent 0a771f7b

net/netfilter/nf_tables_api.c

+3 −2
Original line number Diff line number Diff line
@@ -3811,8 +3811,6 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, 
			NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);

			return PTR_ERR(chain);

		}

		if (nft_chain_is_bound(chain))

			return -EOPNOTSUPP;



	} else if (nla[NFTA_RULE_CHAIN_ID]) {

		chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID],
@@ -3825,6 +3823,9 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, 
		return -EINVAL;

	}



	if (nft_chain_is_bound(chain))

		return -EOPNOTSUPP;



	if (nla[NFTA_RULE_HANDLE]) {

		handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));

		rule = __nft_rule_lookup(chain, handle);