tree dc82af4b36984f996d29c165bb1ff8da58e83f5d
parent 33a68a734a59468d3e3c6285ad655512fc913532
author Phil Sutter <phil@nwl.cc> 1645023338 +0100
committer Michael Kochera <kochera@google.com> 1706280696 +0000

netfilter: nf_tables: Reject tables of unsupported family

commit f1082dd31fe461d482d69da2a8eccfeb7bf07ac2 upstream.

An nftables family is merely a hollow container, its family just a
number and such not reliant on compile-time options other than nftables
support itself. Add an artificial check so attempts at using a family
the kernel can't support fail as early as possible. This helps user
space detect kernels which lack e.g. NFPROTO_INET.

BUG=b/321923349
TEST=None
RELEASE_NOTE=Fixed CVE-2023-6040 in the linux kernel.

cos-patch: security-high
Change-Id: I730b947d2d8e248a7ad1fed28e55cbf154118fb3
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/64223
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Oleksandr Tymoshenko <ovt@google.com>