From ef2c7189f5745deb89aca41f4a9654c2985ef8fe Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 14 Sep 2022 18:07:27 +0800 Subject: [PATCH] netfilter: nf_tables: disallow binding to already bound chain stable inclusion from stable-v5.10.140 commit c08a104a8bce832f6e7a4e8d9ac091777b9982ea category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PEDR?from=project-issue CVE: CVE-2022-39190 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c08a104a8bce832f6e7a4e8d9ac091777b9982ea -------------------------------- [ Upstream commit e02f0d3970404bfea385b6edb86f2d936db0ea2b ] Update nft_data_init() to report EINVAL if chain is already bound. Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") Reported-by: Gwangun Jung Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Conflicts: net/netfilter/nf_tables_api.c Signed-off-by: Ziyang Xuan Reviewed-by: Yue Haibing Reviewed-by: Xiu Jianfeng Signed-off-by: Zheng Zengkai --- net/netfilter/nf_tables_api.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 6a26a9cfdb58..44b6d7de8100 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -8658,6 +8658,8 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, return PTR_ERR(chain); if (nft_is_base_chain(chain)) return -EOPNOTSUPP; + if (nft_chain_is_bound(chain)) + return -EINVAL; chain->use++; data->verdict.chain = chain; -- GitLab