tree 0e93e80e284d9e90afdf27d95bef7c76918c6ef8
parent 218dbd86823505f90d29d03291fa4cc19bedfdb2
author Pablo Neira Ayuso <pablo@netfilter.org> 1690122286 +0200
committer Michael Kochera <kochera@google.com> 1694948217 +0000

netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR

[ Upstream commit 0a771f7b266b02d262900c75f1e175c7fe76fec2 ]

On error when building the rule, the immediate expression unbinds the
chain, hence objects can be deactivated by the transaction records.

Otherwise, it is possible to trigger the following warning:

 WARNING: CPU: 3 PID: 915 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]
 CPU: 3 PID: 915 Comm: chain-bind-err- Not tainted 6.1.39 #1
 RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]

BUG=b/300063359
TEST=None
RELEASE_NOTE=Fixed CVE-2023-4015 in the linux kernel.

cos-patch: security-high
Fixes: 4bedf9eee016 ("netfilter: nf_tables: fix chain binding transaction logic")
Reported-by: Kevin Rich <kevinrich1337@gmail.com>
Change-Id: I545f1724b7a66b85ca5ceaa63f714f6b13568459
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/57312
Reviewed-by: Oleksandr Tymoshenko <ovt@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>