Commit 783c8b11 authored Oct 10, 2023 by Pablo Neira Ayuso Committed by Lu Wei Oct 10, 2023

netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID

stable inclusion
from stable-v5.10.188
commit 30e5460d69e631c0e84db37dba2d8f98648778d4
bugzilla: https://gitee.com/openeuler/kernel/issues/I86JB6

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=30e5460d69e631c0e84db37dba2d8f98648778d4



--------------------------------

[ Upstream commit 0ebc1064 ]

Bail out with EOPNOTSUPP when adding rule to bound chain via
NFTA_RULE_CHAIN_ID. The following warning splat is shown when
adding a rule to a deleted bound chain:

 WARNING: CPU: 2 PID: 13692 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]
 CPU: 2 PID: 13692 Comm: chain-bound-rul Not tainted 6.1.39 #1
 RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]

Fixes: d0e2c7de ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
Reported-by: Kevin Rich <kevinrich1337@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Lu Wei <luwei32@huawei.com>

parent 1405d815

net/netfilter/nf_tables_api.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -3348,8 +3348,6 @@ static int nf_tables_newrule(struct net net, struct sock nlsk,
		NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
		return PTR_ERR(chain);
		}
		if (nft_chain_is_bound(chain))
		return -EOPNOTSUPP;

		} else if (nla[NFTA_RULE_CHAIN_ID]) {
		chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID],
		@@ -3362,6 +3360,9 @@ static int nf_tables_newrule(struct net net, struct sock nlsk,
		return -EINVAL;
		}

		if (nft_chain_is_bound(chain))
		return -EOPNOTSUPP;

		if (nla[NFTA_RULE_HANDLE]) {
		handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
		rule = __nft_rule_lookup(chain, handle);