Commit 67216c05 authored Jun 16, 2023 by Pablo Neira Ayuso Committed by sanglipeng Nov 30, 2023

netfilter: nf_tables: disallow element updates of bound anonymous sets

stable inclusion
from stable-v5.10.186
commit 3d5c09c782a32ac86701c2e4ee5c4a4ba4f155ca
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I8J4KH

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3d5c09c782a32ac86701c2e4ee5c4a4ba4f155ca



--------------------------------

[ Upstream commit c88c535b ]

Anonymous sets come with NFT_SET_CONSTANT from userspace. Although API
allows to create anonymous sets without NFT_SET_CONSTANT, it makes no
sense to allow to add and to delete elements for bound anonymous sets.

Fixes: 96518518 ("netfilter: add nftables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: sanglipeng <sanglipeng1@jd.com>

parent f7b2dd9f

net/netfilter/nf_tables_api.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -5685,7 +5685,8 @@ static int nf_tables_newsetelem(struct net net, struct sock nlsk,
		if (IS_ERR(set))
		return PTR_ERR(set);

		if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
		if (!list_empty(&set->bindings) &&
		(set->flags & (NFT_SET_CONSTANT \| NFT_SET_ANONYMOUS)))
		return -EBUSY;

		nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
		@@ -5881,7 +5882,9 @@ static int nf_tables_delsetelem(struct net net, struct sock nlsk,
		set = nft_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
		if (IS_ERR(set))
		return PTR_ERR(set);
		if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)

		if (!list_empty(&set->bindings) &&
		(set->flags & (NFT_SET_CONSTANT \| NFT_SET_ANONYMOUS)))
		return -EBUSY;

		if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {