tree de651e9339a6fd3e3b80fb41a4a3657cd47a95c6
parent a8da4ff75dee2d123b2fb597725e67a1daeb5f32
author Pablo Neira Ayuso <pablo@netfilter.org> 1705098525 +0100
committer Oleksandr Tymoshenko <ovt@google.com> 1707340939 +0000

netfilter: nf_tables: check if catch-all set element is active in next generation

commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7 upstream.

When deactivating the catch-all set element, check the state in the next
generation that represents this transaction.

This bug uncovered after the recent removal of the element busy mark
a2dd0233cbc4 ("netfilter: nf_tables: remove busy mark and gc batch API").

BUG=b/323598805
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2024-1085 in the Linux kernel.

cos-patch: security-high
Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support")
Cc: stable@vger.kernel.org
Reported-by: lonial con <kongln9170@gmail.com>
Change-Id: I4dd2fd7192d5e32e0f1db49dace025a2ecf1d49d
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/64698
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Arnav Kansal <rnv@google.com>