Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 35d0ac90 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: fix set->nelems counting with no NLM_F_EXCL 



If the element exists and no NLM_F_EXCL is specified, do not bump
set->nelems, otherwise we leak one set element slot. This problem
amplifies if the set is full since the abort path always decrements the
counter for the -ENFILE case too, giving one spare extra slot.

Fix this by moving set->nelems update to nft_add_set_elem() after
successful element insertion. Moreover, remove the element if the set is
full so there is no need to rely on the abort path to undo things
anymore.

Fixes: c016c7e4 ("netfilter: nf_tables: honor NLM_F_EXCL flag in set element insertion")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 5ce6b04c

net/netfilter/nf_tables_api.c

+9 −7
Original line number Diff line number Diff line
@@ -3745,10 +3745,18 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, 
		goto err5;

	}



	if (set->size &&

	    !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {

		err = -ENFILE;

		goto err6;

	}



	nft_trans_elem(trans) = elem;

	list_add_tail(&trans->list, &ctx->net->nft.commit_list);

	return 0;



err6:

	set->ops->remove(set, &elem);

err5:

	kfree(trans);

err4:
@@ -3795,16 +3803,10 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk, 
		return -EBUSY;



	nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {

		if (set->size &&

		    !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact))

			return -ENFILE;



		err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);

		if (err < 0) {

			atomic_dec(&set->nelems);

		if (err < 0)

			break;

	}

	}

	return err;

}