| Message ID | 20230720165143.30208-2-fw@strlen.de (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | ddbd8be68941985f166f5107109a90ce13147c44 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,1/5] netfilter: nf_tables: fix spurious set element insertion failure | expand |
Hello: This series was applied to netdev/net.git (main) by Florian Westphal <fw@strlen.de>: On Thu, 20 Jul 2023 18:51:33 +0200 you wrote: > On some platforms there is a padding hole in the nft_verdict > structure, between the verdict code and the chain pointer. > > On element insertion, if the new element clashes with an existing one and > NLM_F_EXCL flag isn't set, we want to ignore the -EEXIST error as long as > the data associated with duplicated element is the same as the existing > one. The data equality check uses memcmp. > > [...] Here is the summary with links: - [net,1/5] netfilter: nf_tables: fix spurious set element insertion failure https://git.kernel.org/netdev/net/c/ddbd8be68941 - [net,2/5] netfilter: nf_tables: can't schedule in nft_chain_validate https://git.kernel.org/netdev/net/c/314c82841602 - [net,3/5] netfilter: nft_set_pipapo: fix improper element removal https://git.kernel.org/netdev/net/c/87b5a5c20940 - [net,4/5] netfilter: nf_tables: skip bound chain in netns release path https://git.kernel.org/netdev/net/c/751d460ccff3 - [net,5/5] netfilter: nf_tables: skip bound chain on rule flush https://git.kernel.org/netdev/net/c/6eaf41e87a22 You are awesome, thank you!
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 237f739da3ca..79c7eee33dcd 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -10517,6 +10517,9 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, if (!tb[NFTA_VERDICT_CODE]) return -EINVAL; + + /* zero padding hole for memcmp */ + memset(data, 0, sizeof(*data)); data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE])); switch (data->verdict.code) {
On some platforms there is a padding hole in the nft_verdict structure, between the verdict code and the chain pointer. On element insertion, if the new element clashes with an existing one and NLM_F_EXCL flag isn't set, we want to ignore the -EEXIST error as long as the data associated with duplicated element is the same as the existing one. The data equality check uses memcmp. For normal data (NFT_DATA_VALUE) this works fine, but for NFT_DATA_VERDICT padding area leads to spurious failure even if the verdict data is the same. This then makes the insertion fail with 'already exists' error, even though the new "key : data" matches an existing entry and userspace told the kernel that it doesn't want to receive an error indication. Fixes: c016c7e45ddf ("netfilter: nf_tables: honor NLM_F_EXCL flag in set element insertion") Signed-off-by: Florian Westphal <fw@strlen.de> --- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)