net, neigh: Reject creating NUD_PERMANENT with NTF_MANAGED entries

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2193175

commit 30fc7ef
Author: Daniel Borkmann <daniel@iogearbox.net>
Date:   Wed Oct 13 15:21:40 2021 +0200

    net, neigh: Reject creating NUD_PERMANENT with NTF_MANAGED entries

    The combination of NUD_PERMANENT + NTF_MANAGED is not supported and does
    not make sense either given the former indicates a static/fixed neighbor
    entry whereas the latter a dynamically resolved one. While it is possible
    to transition from one over to the other, we should however reject such
    creation attempts.

    Fixes: 7482e38 ("net, neigh: Add NTF_MANAGED flag for managed neighbor entries")
    Suggested-by: David Ahern <dsahern@kernel.org>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Reviewed-by: David Ahern <dsahern@kernel.org>
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Ivan Vecera <ivecera@redhat.com>

Author: ivecera

net/core/neighbour.c

@@ -2002,15 +2002,20 @@ static int neigh_add(struct sk_buff *skb, struct nlmsghdr *nlh,
 
 	neigh = neigh_lookup(tbl, dst, dev);
 	if (neigh == NULL) {
-		bool exempt_from_gc;
+		bool ndm_permanent  = ndm->ndm_state & NUD_PERMANENT;
+		bool exempt_from_gc = ndm_permanent ||
+				      ndm_flags & NTF_EXT_LEARNED;
 
 		if (!(nlh->nlmsg_flags & NLM_F_CREATE)) {
 			err = -ENOENT;
 			goto out;
 		}
+		if (ndm_permanent && (ndm_flags & NTF_MANAGED)) {
+			NL_SET_ERR_MSG(extack, "Invalid NTF_* flag for permanent entry");
+			err = -EINVAL;
+			goto out;
+		}
 
-		exempt_from_gc = ndm->ndm_state & NUD_PERMANENT ||
-				 ndm_flags & NTF_EXT_LEARNED;
 		neigh = ___neigh_create(tbl, dst, dev,
 					ndm_flags &
 					(NTF_EXT_LEARNED | NTF_MANAGED),