Attachment 875371 Details for Bug 1215420

[patch] 0002-netfilter-take-a-reference-when-looking-up-nft_sets.patch

0002-netfilter-take-a-reference-when-looking-up-nft_sets.patch (text/plain), 7.35 KB, created by Hannes Reinecke on 2024-06-07 14:33:06 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Hannes Reinecke

Created: 2024-06-07 14:33:06 UTC

Size: 7.35 KB

patch

obsolete

>From 765a0c732d9d40264ebf8a51dc1fd3603c416fb0 Mon Sep 17 00:00:00 2001
>From: Hannes Reinecke <hare@kernel.org>
>Date: Fri, 7 Jun 2024 16:14:37 +0200
>Subject: [PATCH 2/2] netfilter: take a reference when looking up nft_sets
>
>When looking up nft_sets we should be taking a reference to
>ensure that the element doesn't vanish from underneath us.
>
>Signed-off-by: Hannes Reinecke <hare@suse.de>
>---
> net/netfilter/nf_tables_api.c | 106 ++++++++++++++++++++++++----------
> 1 file changed, 77 insertions(+), 29 deletions(-)
>
>diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
>index 29836b8575f8a..898296ff99ffa 100644
>--- a/net/netfilter/nf_tables_api.c
>+++ b/net/netfilter/nf_tables_api.c
>@@ -2397,8 +2397,11 @@ struct nft_set *nf_tables_set_lookup(const struct nft_table *table,
> 		return ERR_PTR(-EINVAL);
> 
> 	list_for_each_entry(set, &table->sets, list) {
>-		if (!nla_strcmp(nla, set->name))
>+		if (!nla_strcmp(nla, set->name)) {
>+			if (!nft_set_get(set))
>+				break;
> 			return set;
>+		}
> 	}
> 	return ERR_PTR(-ENOENT);
> }
>@@ -2407,12 +2410,17 @@ struct nft_set *nf_tables_set_lookup_byid(const struct net *net,
> 					  const struct nlattr *nla)
> {
> 	struct nft_trans *trans;
>+	struct nft_set *set;
> 	u32 id = ntohl(nla_get_be32(nla));
> 
> 	list_for_each_entry(trans, &net->nft.commit_list, list) {
> 		if (trans->msg_type == NFT_MSG_NEWSET &&
>-		    id == nft_trans_set_id(trans))
>+		    id == nft_trans_set_id(trans)) {
>+			set = nft_trans_set(trans);
>+			if (!nft_set_get(set))
>+				break;
> 			return nft_trans_set(trans);
>+		}
> 	}
> 	return ERR_PTR(-ENOENT);
> }
>@@ -2672,21 +2680,27 @@ static int nf_tables_getset(struct sock *nlsk, struct sk_buff *skb,
> 	set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME]);
> 	if (IS_ERR(set))
> 		return PTR_ERR(set);
>-	if (set->flags & NFT_SET_INACTIVE)
>-		return -ENOENT;
>+	if (set->flags & NFT_SET_INACTIVE) {
>+		err = -ENOENT;
>+		goto out_put;
>+	}
> 
> 	skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
>-	if (skb2 == NULL)
>-		return -ENOMEM;
>+	if (skb2 == NULL) {
>+		err = -ENOMEM;
>+		goto out_put;
>+	}
> 
> 	err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0);
> 	if (err < 0)
> 		goto err;
>-
>+	nft_set_put((struct nft_set *)set);
> 	return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid);
> 
> err:
> 	kfree_skb(skb2);
>+out_put:
>+	nft_set_put((struct nft_set *)set);
> 	return err;
> }
> 
>@@ -2821,11 +2835,13 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
> 	}
> 
> 	if (set != NULL) {
>+		err = 0;
> 		if (nlh->nlmsg_flags & NLM_F_EXCL)
>-			return -EEXIST;
>-		if (nlh->nlmsg_flags & NLM_F_REPLACE)
>-			return -EOPNOTSUPP;
>-		return 0;
>+			err = -EEXIST;
>+		else if (nlh->nlmsg_flags & NLM_F_REPLACE)
>+			err = -EOPNOTSUPP;
>+		nft_set_put(set);
>+		return err;
> 	}
> 
> 	if (!(nlh->nlmsg_flags & NLM_F_CREATE))
>@@ -2917,12 +2933,18 @@ static int nf_tables_delset(struct net *net, struct sock *nlsk,
> 	set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_NAME]);
> 	if (IS_ERR(set))
> 		return PTR_ERR(set);
>-	if (set->flags & NFT_SET_INACTIVE)
>-		return -ENOENT;
>-	if (!list_empty(&set->bindings))
>-		return -EBUSY;
>-
>-	return nft_delset(&ctx, set);
>+	if (set->flags & NFT_SET_INACTIVE) {
>+		err = -ENOENT;
>+		goto out_put;
>+	}
>+	if (!list_empty(&set->bindings)) {
>+		err = -EBUSY;
>+		goto out_put;
>+	}
>+	err = nft_delset(&ctx, set);
>+out_put:
>+	nft_set_put(set);
>+	return err;
> }
> 
> static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
>@@ -3172,8 +3194,10 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
> 	set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
> 	if (IS_ERR(set))
> 		return PTR_ERR(set);
>-	if (set->flags & NFT_SET_INACTIVE)
>+	if (set->flags & NFT_SET_INACTIVE) {
>+		nft_set_put((struct nft_set *)set);
> 		return -ENOENT;
>+	}
> 
> 	event  = NFT_MSG_NEWSETELEM;
> 	event |= NFNL_SUBSYS_NFTABLES << 8;
>@@ -3182,22 +3206,30 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
> 
> 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct nfgenmsg),
> 			NLM_F_MULTI);
>-	if (nlh == NULL)
>+	if (nlh == NULL) {
>+		err = -ENOSPC;
> 		goto nla_put_failure;
>+	}
> 
> 	nfmsg = nlmsg_data(nlh);
> 	nfmsg->nfgen_family = ctx.afi->family;
> 	nfmsg->version      = NFNETLINK_V0;
> 	nfmsg->res_id	    = htons(ctx.net->nft.base_seq & 0xffff);
> 
>-	if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, ctx.table->name))
>+	if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, ctx.table->name)) {
>+		err = -ENOSPC;
> 		goto nla_put_failure;
>-	if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
>+	}
>+	if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name)) {
>+		err = -ENOSPC;
> 		goto nla_put_failure;
>+	}
> 
> 	nest = nla_nest_start(skb, NFTA_SET_ELEM_LIST_ELEMENTS);
>-	if (nest == NULL)
>+	if (nest == NULL) {
>+		err = -ENOSPC;
> 		goto nla_put_failure;
>+	}
> 
> 	args.cb		= cb;
> 	args.skb	= skb;
>@@ -3209,6 +3241,7 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
> 
> 	nla_nest_end(skb, nest);
> 	nlmsg_end(skb, nlh);
>+	nft_set_put((struct nft_set *)set);
> 
> 	if (args.iter.err && args.iter.err != -EMSGSIZE)
> 		return args.iter.err;
>@@ -3219,6 +3252,7 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
> 	return skb->len;
> 
> nla_put_failure:
>+	nft_set_put((struct nft_set *)set);
> 	return -ENOSPC;
> }
> 
>@@ -3238,16 +3272,22 @@ static int nf_tables_getsetelem(struct sock *nlsk, struct sk_buff *skb,
> 	set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
> 	if (IS_ERR(set))
> 		return PTR_ERR(set);
>-	if (set->flags & NFT_SET_INACTIVE)
>-		return -ENOENT;
>+	if (set->flags & NFT_SET_INACTIVE) {
>+		err = -ENOENT;
>+		goto out_put;
>+	}
> 
> 	if (nlh->nlmsg_flags & NLM_F_DUMP) {
> 		struct netlink_dump_control c = {
> 			.dump = nf_tables_dump_set,
> 		};
>-		return netlink_dump_start(nlsk, skb, nlh, &c);
>+		err = netlink_dump_start(nlsk, skb, nlh, &c);
>+		goto out_put;
> 	}
>-	return -EOPNOTSUPP;
>+	err = -EOPNOTSUPP;
>+out_put:
>+	nft_set_put((struct nft_set *)set);
>+	return err;
> }
> 
> static int nf_tables_fill_setelem_info(struct sk_buff *skb,
>@@ -3569,13 +3609,17 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
> 			return PTR_ERR(set);
> 	}
> 
>-	if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
>+	if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT) {
>+		nft_set_put(set);
> 		return -EBUSY;
>+	}
> 
> 	nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
> 		if (set->size &&
>-		    !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact))
>+		    !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
>+			nft_set_put(set);
> 			return -ENFILE;
>+		}
> 
> 		err = nft_add_set_elem(&ctx, set, attr);
> 		if (err < 0) {
>@@ -3583,6 +3627,7 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
> 			break;
> 		}
> 	}
>+	nft_set_put(set);
> 	return err;
> }
> 
>@@ -3656,8 +3701,10 @@ static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
> 	set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET]);
> 	if (IS_ERR(set))
> 		return PTR_ERR(set);
>-	if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
>+	if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT) {
>+		nft_set_put(set);
> 		return -EBUSY;
>+	}
> 
> 	nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
> 		err = nft_del_setelem(&ctx, set, attr);
>@@ -3666,6 +3713,7 @@ static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
> 
> 		set->ndeact++;
> 	}
>+	nft_set_put(set);
> 	return err;
> }
> 
>-- 
>2.35.3
>

Actions: View | Diff

Attachments on bug 1215420: 875370 | 875371 | 875824