netfilter: nf_tables: validate family when identifying table via handle
[ Upstream commit f6e1532a2697b81da00bfb184e99d15e01e9d98c ]
Validate table family when looking up for it via NFTA_TABLE_HANDLE.
Fixes: 3ecbfd65f5
("netfilter: nf_tables: allocate handle and delete objects via handle")
Reported-by: Xingyuan Mo <hdthky0@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
5eeba00a89
commit
fa72b6e62f
|
@ -805,7 +805,7 @@ static struct nft_table *nft_table_lookup(const struct net *net,
|
||||||
|
|
||||||
static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
|
static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
|
||||||
const struct nlattr *nla,
|
const struct nlattr *nla,
|
||||||
u8 genmask, u32 nlpid)
|
int family, u8 genmask, u32 nlpid)
|
||||||
{
|
{
|
||||||
struct nftables_pernet *nft_net;
|
struct nftables_pernet *nft_net;
|
||||||
struct nft_table *table;
|
struct nft_table *table;
|
||||||
|
@ -813,6 +813,7 @@ static struct nft_table *nft_table_lookup_byhandle(const struct net *net,
|
||||||
nft_net = nft_pernet(net);
|
nft_net = nft_pernet(net);
|
||||||
list_for_each_entry(table, &nft_net->tables, list) {
|
list_for_each_entry(table, &nft_net->tables, list) {
|
||||||
if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
|
if (be64_to_cpu(nla_get_be64(nla)) == table->handle &&
|
||||||
|
table->family == family &&
|
||||||
nft_active_genmask(table, genmask)) {
|
nft_active_genmask(table, genmask)) {
|
||||||
if (nft_table_has_owner(table) &&
|
if (nft_table_has_owner(table) &&
|
||||||
nlpid && table->nlpid != nlpid)
|
nlpid && table->nlpid != nlpid)
|
||||||
|
@ -1546,7 +1547,7 @@ static int nf_tables_deltable(struct sk_buff *skb, const struct nfnl_info *info,
|
||||||
|
|
||||||
if (nla[NFTA_TABLE_HANDLE]) {
|
if (nla[NFTA_TABLE_HANDLE]) {
|
||||||
attr = nla[NFTA_TABLE_HANDLE];
|
attr = nla[NFTA_TABLE_HANDLE];
|
||||||
table = nft_table_lookup_byhandle(net, attr, genmask,
|
table = nft_table_lookup_byhandle(net, attr, family, genmask,
|
||||||
NETLINK_CB(skb).portid);
|
NETLINK_CB(skb).portid);
|
||||||
} else {
|
} else {
|
||||||
attr = nla[NFTA_TABLE_NAME];
|
attr = nla[NFTA_TABLE_NAME];
|
||||||
|
|
Loading…
Reference in New Issue