Skip to content

Commit

Permalink
netfilter: nf_tables: report use refcount overflow
Browse files Browse the repository at this point in the history
commit 1689f25 upstream.

Overflow use refcount checks are not complete.

Add helper function to deal with object reference counter tracking.
Report -EMFILE in case UINT_MAX is reached.

nft_use_dec() splats in case that reference counter underflows,
which should not ever happen.

Add nft_use_inc_restore() and nft_use_dec_restore() which are used
to restore reference counter from error and abort paths.

Use u32 in nft_flowtable and nft_object since helper functions cannot
work on bitfields.

Remove the few early incomplete checks now that the helper functions
are in place and used to check for refcount overflow.

Fixes: 9651851 ("netfilter: add nftables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
ummakynes authored and gregkh committed Aug 16, 2023
1 parent c21fddc commit f3f0f95
Show file tree
Hide file tree
Showing 5 changed files with 141 additions and 75 deletions.
31 changes: 27 additions & 4 deletions include/net/netfilter/nf_tables.h
Expand Up @@ -1192,6 +1192,29 @@ int __nft_release_basechain(struct nft_ctx *ctx);

unsigned int nft_do_chain(struct nft_pktinfo *pkt, void *priv);

static inline bool nft_use_inc(u32 *use)
{
if (*use == UINT_MAX)
return false;

(*use)++;

return true;
}

static inline void nft_use_dec(u32 *use)
{
WARN_ON_ONCE((*use)-- == 0);
}

/* For error and abort path: restore use counter to previous state. */
static inline void nft_use_inc_restore(u32 *use)
{
WARN_ON_ONCE(!nft_use_inc(use));
}

#define nft_use_dec_restore nft_use_dec

/**
* struct nft_table - nf_tables table
*
Expand Down Expand Up @@ -1275,8 +1298,8 @@ struct nft_object {
struct list_head list;
struct rhlist_head rhlhead;
struct nft_object_hash_key key;
u32 genmask:2,
use:30;
u32 genmask:2;
u32 use;
u64 handle;
u16 udlen;
u8 *udata;
Expand Down Expand Up @@ -1378,8 +1401,8 @@ struct nft_flowtable {
char *name;
int hooknum;
int ops_len;
u32 genmask:2,
use:30;
u32 genmask:2;
u32 use;
u64 handle;
/* runtime data below here */
struct list_head hook_list ____cacheline_aligned;
Expand Down

0 comments on commit f3f0f95

Please sign in to comment.