Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net. There is a larger batch of fixes still pending that will follow up asap, this is what I deemed to be more urgent at this time: 1) Use clone view in pipapo set backend to release elements from destroy path, otherwise it is possible to destroy elements twice. 2) Incorrect check for internal table flags lead to bogus transaction objects. 3) Fix counters memleak in netdev basechain update error path, from Quan Tian. netfilter pull request 24-03-21 * tag 'nf-24-03-21' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: Fix a memory leak in nf_tables_updchain netfilter: nf_tables: do not compare internal table flags on updates netfilter: nft_set_pipapo: release elements in clone only from destroy path ====================
Unified · Split
| @@ -1213,7 +1213,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx) · 1212 unmodified lines | |||
| 1213 | if (flags & ~NFT_TABLE_F_MASK) | 1213 | if (flags & ~NFT_TABLE_F_MASK) |
| 1214 | return -EOPNOTSUPP; | 1214 | return -EOPNOTSUPP; |
| 1215 | 1215 | ||
| 1216 | if (flags == ctx->table->flags) | 1216 | if (flags == (ctx->table->flags & NFT_TABLE_F_MASK)) |
| 1217 | return 0; | 1217 | return 0; |
| 1218 | 1218 | ||
| 1219 | if ((nft_table_has_owner(ctx->table) && | 1219 | if ((nft_table_has_owner(ctx->table) && |
| @@ -2631,19 +2631,6 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, · 1411 unmodified lines | |||
| 2631 | } | 2631 | } |
| 2632 | } | 2632 | } |
| 2633 | 2633 | ||
| 2634 | if (nla[NFTA_CHAIN_COUNTERS]) { | ||
| 2635 | if (!nft_is_base_chain(chain)) { | ||
| 2636 | err = -EOPNOTSUPP; | ||
| 2637 | goto err_hooks; | ||
| 2638 | } | ||
| 2639 | |||
| 2640 | stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); | ||
| 2641 | if (IS_ERR(stats)) { | ||
| 2642 | err = PTR_ERR(stats); | ||
| 2643 | goto err_hooks; | ||
| 2644 | } | ||
| 2645 | } | ||
| 2646 | |||
| 2647 | if (!(table->flags & NFT_TABLE_F_DORMANT) && | 2634 | if (!(table->flags & NFT_TABLE_F_DORMANT) && |
| 2648 | nft_is_base_chain(chain) && | 2635 | nft_is_base_chain(chain) && |
| 2649 | !list_empty(&hook.list)) { | 2636 | !list_empty(&hook.list)) { |
| @@ -2658,6 +2645,20 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, · 8 unmodified lines | |||
| 2658 | } | 2645 | } |
| 2659 | 2646 | ||
| 2660 | unregister = true; | 2647 | unregister = true; |
| 2648 | |||
| 2649 | if (nla[NFTA_CHAIN_COUNTERS]) { | ||
| 2650 | if (!nft_is_base_chain(chain)) { | ||
| 2651 | err = -EOPNOTSUPP; | ||
| 2652 | goto err_hooks; | ||
| 2653 | } | ||
| 2654 | |||
| 2655 | stats = nft_stats_alloc(nla[NFTA_CHAIN_COUNTERS]); | ||
| 2656 | if (IS_ERR(stats)) { | ||
| 2657 | err = PTR_ERR(stats); | ||
| 2658 | goto err_hooks; | ||
| 2659 | } | ||
| 2660 | } | ||
| 2661 | |||
| 2661 | err = -ENOMEM; | 2662 | err = -ENOMEM; |
| 2662 | trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN, | 2663 | trans = nft_trans_alloc(ctx, NFT_MSG_NEWCHAIN, |
| 2663 | sizeof(struct nft_trans_chain)); | 2664 | sizeof(struct nft_trans_chain)); |
| @@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx, · 2328 unmodified lines | |||
| 2329 | if (m) { | 2329 | if (m) { |
| 2330 | rcu_barrier(); | 2330 | rcu_barrier(); |
| 2331 | 2331 | ||
| 2332 | nft_set_pipapo_match_destroy(ctx, set, m); | ||
| 2333 | |||
| 2334 | for_each_possible_cpu(cpu) | 2332 | for_each_possible_cpu(cpu) |
| 2335 | pipapo_free_scratch(m, cpu); | 2333 | pipapo_free_scratch(m, cpu); |
| 2336 | free_percpu(m->scratch); | 2334 | free_percpu(m->scratch); |
| @@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx, · 5 unmodified lines | |||
| 2342 | if (priv->clone) { | 2340 | if (priv->clone) { |
| 2343 | m = priv->clone; | 2341 | m = priv->clone; |
| 2344 | 2342 | ||
| 2345 | if (priv->dirty) | 2343 | nft_set_pipapo_match_destroy(ctx, set, m); |
| 2346 | nft_set_pipapo_match_destroy(ctx, set, m); | ||
| 2347 | 2344 | ||
| 2348 | for_each_possible_cpu(cpu) | 2345 | for_each_possible_cpu(cpu) |
| 2349 | pipapo_free_scratch(priv->clone, cpu); | 2346 | pipapo_free_scratch(priv->clone, cpu); |