xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: nf_tables: disallow jump to implicit chain from set element

Browse Source 
[ Upstream commit f323ef3a0d49e147365284bc1f02212e617b7f09 ]

Extend struct nft_data_desc to add a flag field that specifies
nft_data_init() is being called for set element data.

Use it to disallow jump to implicit chain from set element, only jump
to chain via immediate expression is allowed.

Fixes: d0e2c7de92 ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Pablo Neira Ayuso
2022-08-08 19:30:07 +02:00
committed by Greg Kroah-Hartman
parent 9882768759
commit 6301a73bd8
2 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
include/net/netfilter/nf_tables.h
View File

@@ -176,10 +176,15 @@ struct nft_ctx {
bool report; bool report;
}; };
enum nft_data_desc_flags {
NFT_DATA_DESC_SETELEM = (1 << 0),
};
struct nft_data_desc { struct nft_data_desc {
enum nft_data_types type; enum nft_data_types type;
unsigned int size; unsigned int size;
unsigned int len; unsigned int len;
unsigned int flags;
}; };
int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data, int nft_data_init(const struct nft_ctx *ctx, struct nft_data *data,

4
net/netfilter/nf_tables_api.c
View File

@@ -4865,6 +4865,7 @@ static int nft_setelem_parse_data(struct nft_ctx *ctx, struct nft_set *set,
desc->type = dtype; desc->type = dtype;
desc->size = NFT_DATA_VALUE_MAXLEN; desc->size = NFT_DATA_VALUE_MAXLEN;
desc->len = set->dlen; desc->len = set->dlen;
desc->flags = NFT_DATA_DESC_SETELEM;
return nft_data_init(ctx, data, desc, attr); return nft_data_init(ctx, data, desc, attr);
} }
@@ -8677,6 +8678,9 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
return PTR_ERR(chain); return PTR_ERR(chain);
if (nft_is_base_chain(chain)) if (nft_is_base_chain(chain))
return -EOPNOTSUPP; return -EOPNOTSUPP;
if (desc->flags & NFT_DATA_DESC_SETELEM &&
chain->flags & NFT_CHAIN_BINDING)
return -EINVAL;
chain->use++; chain->use++;
data->verdict.chain = chain; data->verdict.chain = chain;