Commit e8cafee5 authored by Phil Sutter's avatar Phil Sutter Committed by Liu Jian
Browse files

netfilter: nf_tables: Reject tables of unsupported family

mainline inclusion
from mainline-v5.18-rc1
commit f1082dd3
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8VPKT
CVE: CVE-2023-6040

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f1082dd31fe461d482d69da2a8eccfeb7bf07ac2



---------------------------

An nftables family is merely a hollow container, its family just a
number and such not reliant on compile-time options other than nftables
support itself. Add an artificial check so attempts at using a family
the kernel can't support fail as early as possible. This helps user
space detect kernels which lack e.g. NFPROTO_INET.

Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>

Conflicts:
	net/netfilter/nf_tables_api.c
parent deb75da8
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment