Skip to content

Commit ac1a21d

Browse files
author
Paolo Abeni
committed
Merge tag 'nf-24-04-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: Patch #1 amends a missing spot where the set iterator type is unset. This is fixing a issue in the previous pull request. Patch #2 fixes the delete set command abort path by restoring state of the elements. Reverse logic for the activate (abort) case otherwise element state is not restored, this requires to move the check for active/inactive elements to the set iterator callback. From the deactivate path, toggle the next generation bit and from the activate (abort) path, clear the next generation bitmask. Patch #3 skips elements already restored by delete set command from the abort path in case there is a previous delete element command in the batch. Check for the next generation bit just like it is done via set iteration to restore maps. netfilter pull request 24-04-18 * tag 'nf-24-04-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: fix memleak in map from abort path netfilter: nf_tables: restore set elements when delete set fails netfilter: nf_tables: missing iterator type in lookup walk ==================== Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Paolo Abeni <[email protected]>
2 parents d10a7f5 + 86a1471 commit ac1a21d

File tree

6 files changed

+62
-23
lines changed

6 files changed

+62
-23
lines changed

‎net/netfilter/nf_tables_api.c

Lines changed: 54 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -594,6 +594,12 @@ static int nft_mapelem_deactivate(const struct nft_ctx *ctx,
594594
const struct nft_set_iter *iter,
595595
struct nft_elem_priv *elem_priv)
596596
{
597+
struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);
598+
599+
if (!nft_set_elem_active(ext, iter->genmask))
600+
return 0;
601+
602+
nft_set_elem_change_active(ctx->net, set, ext);
597603
nft_setelem_data_deactivate(ctx->net, set, elem_priv);
598604

599605
return 0;
@@ -617,6 +623,7 @@ static void nft_map_catchall_deactivate(const struct nft_ctx *ctx,
617623
if (!nft_set_elem_active(ext, genmask))
618624
continue;
619625

626+
nft_set_elem_change_active(ctx->net, set, ext);
620627
nft_setelem_data_deactivate(ctx->net, set, catchall->elem);
621628
break;
622629
}
@@ -3880,6 +3887,9 @@ int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set,
38803887
const struct nft_data *data;
38813888
int err;
38823889

3890+
if (!nft_set_elem_active(ext, iter->genmask))
3891+
return 0;
3892+
38833893
if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
38843894
*nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
38853895
return 0;
@@ -3903,17 +3913,20 @@ int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set,
39033913

39043914
int nft_set_catchall_validate(const struct nft_ctx *ctx, struct nft_set *set)
39053915
{
3906-
u8 genmask = nft_genmask_next(ctx->net);
3916+
struct nft_set_iter dummy_iter = {
3917+
.genmask = nft_genmask_next(ctx->net),
3918+
};
39073919
struct nft_set_elem_catchall *catchall;
3920+
39083921
struct nft_set_ext *ext;
39093922
int ret = 0;
39103923

39113924
list_for_each_entry_rcu(catchall, &set->catchall_list, list) {
39123925
ext = nft_set_elem_ext(set, catchall->elem);
3913-
if (!nft_set_elem_active(ext, genmask))
3926+
if (!nft_set_elem_active(ext, dummy_iter.genmask))
39143927
continue;
39153928

3916-
ret = nft_setelem_validate(ctx, set, NULL, catchall->elem);
3929+
ret = nft_setelem_validate(ctx, set, &dummy_iter, catchall->elem);
39173930
if (ret < 0)
39183931
return ret;
39193932
}
@@ -5402,6 +5415,11 @@ static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
54025415
const struct nft_set_iter *iter,
54035416
struct nft_elem_priv *elem_priv)
54045417
{
5418+
const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);
5419+
5420+
if (!nft_set_elem_active(ext, iter->genmask))
5421+
return 0;
5422+
54055423
return nft_setelem_data_validate(ctx, set, elem_priv);
54065424
}
54075425

@@ -5494,6 +5512,13 @@ static int nft_mapelem_activate(const struct nft_ctx *ctx,
54945512
const struct nft_set_iter *iter,
54955513
struct nft_elem_priv *elem_priv)
54965514
{
5515+
struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);
5516+
5517+
/* called from abort path, reverse check to undo changes. */
5518+
if (nft_set_elem_active(ext, iter->genmask))
5519+
return 0;
5520+
5521+
nft_clear(ctx->net, ext);
54975522
nft_setelem_data_activate(ctx->net, set, elem_priv);
54985523

54995524
return 0;
@@ -5511,6 +5536,7 @@ static void nft_map_catchall_activate(const struct nft_ctx *ctx,
55115536
if (!nft_set_elem_active(ext, genmask))
55125537
continue;
55135538

5539+
nft_clear(ctx->net, ext);
55145540
nft_setelem_data_activate(ctx->net, set, catchall->elem);
55155541
break;
55165542
}
@@ -5785,6 +5811,9 @@ static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
57855811
const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);
57865812
struct nft_set_dump_args *args;
57875813

5814+
if (!nft_set_elem_active(ext, iter->genmask))
5815+
return 0;
5816+
57885817
if (nft_set_elem_expired(ext) || nft_set_elem_is_dead(ext))
57895818
return 0;
57905819

@@ -6635,7 +6664,7 @@ static void nft_setelem_activate(struct net *net, struct nft_set *set,
66356664
struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);
66366665

66376666
if (nft_setelem_is_catchall(set, elem_priv)) {
6638-
nft_set_elem_change_active(net, set, ext);
6667+
nft_clear(net, ext);
66396668
} else {
66406669
set->ops->activate(net, set, elem_priv);
66416670
}
@@ -7194,6 +7223,16 @@ void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
71947223
}
71957224
}
71967225

7226+
static int nft_setelem_active_next(const struct net *net,
7227+
const struct nft_set *set,
7228+
struct nft_elem_priv *elem_priv)
7229+
{
7230+
const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);
7231+
u8 genmask = nft_genmask_next(net);
7232+
7233+
return nft_set_elem_active(ext, genmask);
7234+
}
7235+
71977236
static void nft_setelem_data_activate(const struct net *net,
71987237
const struct nft_set *set,
71997238
struct nft_elem_priv *elem_priv)
@@ -7317,8 +7356,12 @@ static int nft_setelem_flush(const struct nft_ctx *ctx,
73177356
const struct nft_set_iter *iter,
73187357
struct nft_elem_priv *elem_priv)
73197358
{
7359+
const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);
73207360
struct nft_trans *trans;
73217361

7362+
if (!nft_set_elem_active(ext, iter->genmask))
7363+
return 0;
7364+
73227365
trans = nft_trans_alloc_gfp(ctx, NFT_MSG_DELSETELEM,
73237366
sizeof(struct nft_trans_elem), GFP_ATOMIC);
73247367
if (!trans)
@@ -10611,8 +10654,10 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
1061110654
case NFT_MSG_DESTROYSETELEM:
1061210655
te = (struct nft_trans_elem *)trans->data;
1061310656

10614-
nft_setelem_data_activate(net, te->set, te->elem_priv);
10615-
nft_setelem_activate(net, te->set, te->elem_priv);
10657+
if (!nft_setelem_active_next(net, te->set, te->elem_priv)) {
10658+
nft_setelem_data_activate(net, te->set, te->elem_priv);
10659+
nft_setelem_activate(net, te->set, te->elem_priv);
10660+
}
1061610661
if (!nft_setelem_is_catchall(te->set, te->elem_priv))
1061710662
te->set->ndeact--;
1061810663

@@ -10800,6 +10845,9 @@ static int nf_tables_loop_check_setelem(const struct nft_ctx *ctx,
1080010845
{
1080110846
const struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);
1080210847

10848+
if (!nft_set_elem_active(ext, iter->genmask))
10849+
return 0;
10850+
1080310851
if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
1080410852
*nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
1080510853
return 0;

‎net/netfilter/nft_lookup.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,7 @@ static int nft_lookup_validate(const struct nft_ctx *ctx,
216216
return 0;
217217

218218
iter.genmask = nft_genmask_next(ctx->net);
219+
iter.type = NFT_ITER_UPDATE;
219220
iter.skip = 0;
220221
iter.count = 0;
221222
iter.err = 0;

‎net/netfilter/nft_set_bitmap.c

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ static void nft_bitmap_activate(const struct net *net,
172172
nft_bitmap_location(set, nft_set_ext_key(&be->ext), &idx, &off);
173173
/* Enter 11 state. */
174174
priv->bitmap[idx] |= (genmask << off);
175-
nft_set_elem_change_active(net, set, &be->ext);
175+
nft_clear(net, &be->ext);
176176
}
177177

178178
static void nft_bitmap_flush(const struct net *net,
@@ -222,8 +222,6 @@ static void nft_bitmap_walk(const struct nft_ctx *ctx,
222222
list_for_each_entry_rcu(be, &priv->list, head) {
223223
if (iter->count < iter->skip)
224224
goto cont;
225-
if (!nft_set_elem_active(&be->ext, iter->genmask))
226-
goto cont;
227225

228226
iter->err = iter->fn(ctx, set, iter, &be->priv);
229227

‎net/netfilter/nft_set_hash.c

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,7 @@ static void nft_rhash_activate(const struct net *net, const struct nft_set *set,
199199
{
200200
struct nft_rhash_elem *he = nft_elem_priv_cast(elem_priv);
201201

202-
nft_set_elem_change_active(net, set, &he->ext);
202+
nft_clear(net, &he->ext);
203203
}
204204

205205
static void nft_rhash_flush(const struct net *net,
@@ -286,8 +286,6 @@ static void nft_rhash_walk(const struct nft_ctx *ctx, struct nft_set *set,
286286

287287
if (iter->count < iter->skip)
288288
goto cont;
289-
if (!nft_set_elem_active(&he->ext, iter->genmask))
290-
goto cont;
291289

292290
iter->err = iter->fn(ctx, set, iter, &he->priv);
293291
if (iter->err < 0)
@@ -599,7 +597,7 @@ static void nft_hash_activate(const struct net *net, const struct nft_set *set,
599597
{
600598
struct nft_hash_elem *he = nft_elem_priv_cast(elem_priv);
601599

602-
nft_set_elem_change_active(net, set, &he->ext);
600+
nft_clear(net, &he->ext);
603601
}
604602

605603
static void nft_hash_flush(const struct net *net,
@@ -652,8 +650,6 @@ static void nft_hash_walk(const struct nft_ctx *ctx, struct nft_set *set,
652650
hlist_for_each_entry_rcu(he, &priv->table[i], node) {
653651
if (iter->count < iter->skip)
654652
goto cont;
655-
if (!nft_set_elem_active(&he->ext, iter->genmask))
656-
goto cont;
657653

658654
iter->err = iter->fn(ctx, set, iter, &he->priv);
659655
if (iter->err < 0)

‎net/netfilter/nft_set_pipapo.c

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1847,7 +1847,7 @@ static void nft_pipapo_activate(const struct net *net,
18471847
{
18481848
struct nft_pipapo_elem *e = nft_elem_priv_cast(elem_priv);
18491849

1850-
nft_set_elem_change_active(net, set, &e->ext);
1850+
nft_clear(net, &e->ext);
18511851
}
18521852

18531853
/**
@@ -2123,7 +2123,8 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set,
21232123
const struct nft_pipapo_field *f;
21242124
unsigned int i, r;
21252125

2126-
WARN_ON_ONCE(iter->type == NFT_ITER_UNSPEC);
2126+
WARN_ON_ONCE(iter->type != NFT_ITER_READ &&
2127+
iter->type != NFT_ITER_UPDATE);
21272128

21282129
rcu_read_lock();
21292130
if (iter->type == NFT_ITER_READ)
@@ -2148,9 +2149,6 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set,
21482149

21492150
e = f->mt[r].e;
21502151

2151-
if (!nft_set_elem_active(&e->ext, iter->genmask))
2152-
goto cont;
2153-
21542152
iter->err = iter->fn(ctx, set, iter, &e->priv);
21552153
if (iter->err < 0)
21562154
goto out;

‎net/netfilter/nft_set_rbtree.c

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -532,7 +532,7 @@ static void nft_rbtree_activate(const struct net *net,
532532
{
533533
struct nft_rbtree_elem *rbe = nft_elem_priv_cast(elem_priv);
534534

535-
nft_set_elem_change_active(net, set, &rbe->ext);
535+
nft_clear(net, &rbe->ext);
536536
}
537537

538538
static void nft_rbtree_flush(const struct net *net,
@@ -600,8 +600,6 @@ static void nft_rbtree_walk(const struct nft_ctx *ctx,
600600

601601
if (iter->count < iter->skip)
602602
goto cont;
603-
if (!nft_set_elem_active(&rbe->ext, iter->genmask))
604-
goto cont;
605603

606604
iter->err = iter->fn(ctx, set, iter, &rbe->priv);
607605
if (iter->err < 0) {

0 commit comments

Comments
 (0)