Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit caa22879 authored by Florian Westphal's avatar Florian Westphal Committed by Greg Kroah-Hartman
Browse files

netfilter: nf_tables: fix spurious set element insertion failure 



[ Upstream commit ddbd8be68941985f166f5107109a90ce13147c44 ]

On some platforms there is a padding hole in the nft_verdict
structure, between the verdict code and the chain pointer.

On element insertion, if the new element clashes with an existing one and
NLM_F_EXCL flag isn't set, we want to ignore the -EEXIST error as long as
the data associated with duplicated element is the same as the existing
one.  The data equality check uses memcmp.

For normal data (NFT_DATA_VALUE) this works fine, but for NFT_DATA_VERDICT
padding area leads to spurious failure even if the verdict data is the
same.

This then makes the insertion fail with 'already exists' error, even
though the new "key : data" matches an existing entry and userspace
told the kernel that it doesn't want to receive an error indication.

Fixes: c016c7e4 ("netfilter: nf_tables: honor NLM_F_EXCL flag in set element insertion")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent b8944e53

net/netfilter/nf_tables_api.c

+3 −0
Original line number Diff line number Diff line
@@ -7655,6 +7655,9 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, 


	if (!tb[NFTA_VERDICT_CODE])

		return -EINVAL;



	/* zero padding hole for memcmp */

	memset(data, 0, sizeof(*data));

	data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));



	switch (data->verdict.code) {