netfilter: nf_tables: disallow element removal on anonymous sets

jira VULN-597
subsystem-sync netfilter:nf_tables 4.18.0-534
commit-author Pablo Neira Ayuso <[email protected]>
commit 23a3bfd

Anonymous sets need to be populated once at creation and then they are
bound to rule since 938154b ("netfilter: nf_tables: reject unbound
anonymous set before commit phase"), otherwise transaction reports
EINVAL.

Userspace does not need to delete elements of anonymous sets that are
not yet bound, reject this with EOPNOTSUPP.

From flush command path, skip anonymous sets, they are expected to be
bound already. Otherwise, EINVAL is hit at the end of this transaction
for unbound sets.

Fixes: 9651851 ("netfilter: add nftables")
	Signed-off-by: Pablo Neira Ayuso <[email protected]>
(cherry picked from commit 23a3bfd)
	Signed-off-by: Greg Rose <[email protected]>

Author: gvrose8192

net/netfilter/nf_tables_api.c

@@ -1139,8 +1139,7 @@ static int nft_flush_table(struct nft_ctx *ctx)
 		if (!nft_is_active_next(ctx->net, set))
 			continue;
 
-		if (nft_set_is_anonymous(set) &&
-		    !list_empty(&set->bindings))
+		if (nft_set_is_anonymous(set))
 			continue;
 
 		err = nft_delset(ctx, set);
@@ -5921,8 +5920,10 @@ static int nf_tables_delsetelem(struct net *net, struct sock *nlsk,
 	if (IS_ERR(set))
 		return PTR_ERR(set);
 
-	if (!list_empty(&set->bindings) &&
-	    (set->flags & (NFT_SET_CONSTANT | NFT_SET_ANONYMOUS)))
+	if (nft_set_is_anonymous(set))
+		return -EOPNOTSUPP;
+
+	if (!list_empty(&set->bindings) && (set->flags & NFT_SET_CONSTANT))
 		return -EBUSY;
 
 	if (nla[NFTA_SET_ELEM_LIST_ELEMENTS] == NULL) {