commit 6a1c2e8f22cf972cddbce5b9f7bf57e826c970bf
author Robert Kolchmeyer <rkolchmeyer@google.com> Tue Oct 10 23:31:08 2023 -0700
committer Robert Kolchmeyer <rkolchmeyer@google.com> Wed Oct 11 17:49:46 2023 +0000
tree a070ce5aa60af4418ff840218d6d8a723cdb4372
parent 97a866763793c79e4e44e3b2a93caf0483dba3d8

Reapply "netfilter: nf_tables: disallow rule removal from chain binding"

This reverts commit 8658a7d1fd33ec0979010f39b3473c01f2c0b2a6.

BUG=b/302407283
TEST=presubmit
RELEASE_NOTE=None

cos-patch: bug
Change-Id: Ieac2a2842088493c74c3466ff0e607b187131c09
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/59059
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Oleksandr Tymoshenko <ovt@google.com>
Reviewed-by: Chenglong Tang <chenglongtang@google.com>

net/netfilter/nf_tables_api.c

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index d84da11..a19a911 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1343,7 +1343,7 @@
 		if (!nft_is_active_next(ctx->net, chain))
 			continue;
 
-		if (nft_chain_is_bound(chain))
+		if (nft_chain_binding(chain))
 			continue;
 
 		ctx->chain = chain;
@@ -1388,7 +1388,7 @@
 		if (!nft_is_active_next(ctx->net, chain))
 			continue;
 
-		if (nft_chain_is_bound(chain))
+		if (nft_chain_binding(chain))
 			continue;
 
 		ctx->chain = chain;
@@ -2693,6 +2693,9 @@
 		return PTR_ERR(chain);
 	}
 
+	if (nft_chain_binding(chain))
+		return -EOPNOTSUPP;
+
 	if (info->nlh->nlmsg_flags & NLM_F_NONREC &&
 	    chain->use > 0)
 		return -EBUSY;
@@ -3670,6 +3673,11 @@
 	}
 
 	if (info->nlh->nlmsg_flags & NLM_F_REPLACE) {
+		if (nft_chain_binding(chain)) {
+			err = -EOPNOTSUPP;
+			goto err_destroy_flow_rule;
+		}
+
 		err = nft_delrule(&ctx, old_rule);
 		if (err < 0)
 			goto err_destroy_flow_rule;
@@ -3773,7 +3781,7 @@
 			NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]);
 			return PTR_ERR(chain);
 		}
-		if (nft_chain_is_bound(chain))
+		if (nft_chain_binding(chain))
 			return -EOPNOTSUPP;
 	}
 
@@ -3803,7 +3811,7 @@
 		list_for_each_entry(chain, &table->chains, list) {
 			if (!nft_is_active_next(net, chain))
 				continue;
-			if (nft_chain_is_bound(chain))
+			if (nft_chain_binding(chain))
 				continue;
 
 			ctx.chain = chain;
@@ -10234,7 +10242,7 @@
 	ctx.family = table->family;
 	ctx.table = table;
 	list_for_each_entry(chain, &table->chains, list) {
-		if (nft_chain_is_bound(chain))
+		if (nft_chain_binding(chain))
 			continue;
 
 		ctx.chain = chain;