tree 96f0c4ed842c4b312988d3e9e707ce0fd3086aa1
parent 11770a2f88a28cb70c6bc588236781c69d28bc47
author Pablo Neira Ayuso <pablo@netfilter.org> 1686919526 +0200
committer Robert Kolchmeyer <rkolchmeyer@google.com> 1689100541 +0000

netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain

[ Upstream commit 26b5a5712eb85e253724e56a54c17f8519bd8e4e ]

Add a new state to deal with rule expressions deactivation from the
newrule error path, otherwise the anonymous set remains in the list in
inactive state for the next generation. Mark the set/chain transaction
as unbound so the abort path releases this object, set it as inactive in
the next generation so it is not reachable anymore from this transaction
and reference counter is dropped.

BUG=b/290339378
TEST=presubmit
RELEASE_NOTE=None

cos-patch: security-high
Fixes: 1240eb93f061 ("netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE")
Change-Id: I6001d3b8161b368280633877121884ae2823e46a
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 4004f12aaca8e03e1a7d0e9b0d511b8a23fd6b1e)
Signed-off-by: Robert Kolchmeyer <rkolchmeyer@google.com>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/51892
Reviewed-by: Oleksandr Tymoshenko <ovt@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>