Commit 921ebde3 authored by Tetsuo Handa's avatar Tetsuo Handa Committed by Florian Westphal
Browse files

netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain() 

syzbot is reporting underflow of nft_counters_enabled counter at
nf_tables_addchain() [1], for commit 43eb8949 ("netfilter:
nf_tables: do not leave chain stats enabled on error") missed that
nf_tables_chain_destroy() after nft_basechain_init() in the error path of
nf_tables_addchain() decrements the counter because nft_basechain_init()
makes nft_is_base_chain() return true by setting NFT_CHAIN_BASE flag.

Increment the counter immediately after returning from
nft_basechain_init().

Link:  https://syzkaller.appspot.com/bug?extid=b5d82a651b71cd8a75ab

 [1]
Reported-by: default avatarsyzbot <syzbot+b5d82a651b71cd8a75ab@syzkaller.appspotmail.com>
Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Tested-by: default avatarsyzbot <syzbot+b5d82a651b71cd8a75ab@syzkaller.appspotmail.com>
Fixes: 43eb8949 ("netfilter: nf_tables: do not leave chain stats enabled on error")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
parent 76b907ee

net/netfilter/nf_tables_api.c

+3 −4
Original line number Diff line number Diff line
@@ -2197,7 +2197,6 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 
			      struct netlink_ext_ack *extack)

{

	const struct nlattr * const *nla = ctx->nla;

	struct nft_stats __percpu *stats = NULL;

	struct nft_table *table = ctx->table;

	struct nft_base_chain *basechain;

	struct net *net = ctx->net;
@@ -2212,6 +2211,7 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 
		return -EOVERFLOW;



	if (nla[NFTA_CHAIN_HOOK]) {

		struct nft_stats __percpu *stats = NULL;

		struct nft_chain_hook hook;



		if (flags & NFT_CHAIN_BINDING)
@@ -2245,6 +2245,8 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 
			kfree(basechain);

			return err;

		}

		if (stats)

			static_branch_inc(&nft_counters_enabled);

	} else {

		if (flags & NFT_CHAIN_BASE)

			return -EINVAL;
@@ -2319,9 +2321,6 @@ static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, 
		goto err_unregister_hook;

	}



	if (stats)

		static_branch_inc(&nft_counters_enabled);



	table->use++;



	return 0;