Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 02263db0 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: fix addition/deletion of elements from commit/abort 



We have several problems in this path:

1) There is a use-after-free when removing individual elements from
   the commit path.

2) We have to uninit() the data part of the element from the abort
   path to avoid a chain refcount leak.

3) We have to check for set->flags to see if there's a mapping, instead
   of the element flags.

4) We have to check for !(flags & NFT_SET_ELEM_INTERVAL_END) to skip
   elements that are part of the interval that have no data part, so
   they don't need to be uninit().

Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 2156d321

net/netfilter/nf_tables_api.c

+12 −9
Original line number Diff line number Diff line
@@ -3612,12 +3612,11 @@ static int nf_tables_commit(struct sk_buff *skb) 
						 &te->elem,

						 NFT_MSG_DELSETELEM, 0);

			te->set->ops->get(te->set, &te->elem);

			te->set->ops->remove(te->set, &te->elem);

			nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);

			if (te->elem.flags & NFT_SET_MAP) {

				nft_data_uninit(&te->elem.data,

						te->set->dtype);

			}

			if (te->set->flags & NFT_SET_MAP &&

			    !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))

				nft_data_uninit(&te->elem.data, te->set->dtype);

			te->set->ops->remove(te->set, &te->elem);

			nft_trans_destroy(trans);

			break;

		}
@@ -3658,7 +3657,7 @@ static int nf_tables_abort(struct sk_buff *skb) 
{

	struct net *net = sock_net(skb->sk);

	struct nft_trans *trans, *next;

	struct nft_set *set;

	struct nft_trans_elem *te;



	list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {

		switch (trans->msg_type) {
@@ -3719,9 +3718,13 @@ static int nf_tables_abort(struct sk_buff *skb) 
			break;

		case NFT_MSG_NEWSETELEM:

			nft_trans_elem_set(trans)->nelems--;

			set = nft_trans_elem_set(trans);

			set->ops->get(set, &nft_trans_elem(trans));

			set->ops->remove(set, &nft_trans_elem(trans));

			te = (struct nft_trans_elem *)trans->data;

			te->set->ops->get(te->set, &te->elem);

			nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);

			if (te->set->flags & NFT_SET_MAP &&

			    !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))

				nft_data_uninit(&te->elem.data, te->set->dtype);

			te->set->ops->remove(te->set, &te->elem);

			nft_trans_destroy(trans);

			break;

		case NFT_MSG_DELSETELEM: