Commit 3dd7279f authored Jan 25, 2014 by Patrick McHardy Committed by Pablo Neira Ayuso Feb 05, 2014

netfilter: nf_tables: fix oops when deleting a chain with references

The following commands trigger an oops:

 # nft -i
 nft> add table filter
 nft> add chain filter input { type filter hook input priority 0; }
 nft> add chain filter test
 nft> add rule filter input jump test
 nft> delete chain filter test

We need to check the chain use counter before allowing destruction since
we might have references from sets or jump rules.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=69341


Reported-by: Matthew Ife <deleriux1@gmail.com>
Tested-by: Matthew Ife <deleriux1@gmail.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent 2a53bfb3

net/netfilter/nf_tables_api.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1045,7 +1045,7 @@ static int nf_tables_delchain(struct sock nlsk, struct sk_buff skb,
	if (IS_ERR(chain))		if (IS_ERR(chain))
	return PTR_ERR(chain);		return PTR_ERR(chain);

	if (!list_empty(&chain->rules))		if (!list_empty(&chain->rules) \|\| chain->use > 0)
	return -EBUSY;		return -EBUSY;

	list_del(&chain->list);		list_del(&chain->list);