All of lore.kernel.org
 help / color / mirror / Atom feed
From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: davem@davemloft.net, netdev@vger.kernel.org, kuba@kernel.org,
	pabeni@redhat.com, edumazet@google.com
Subject: [PATCH net 11/14] netfilter: nf_tables: disallow binding to already bound chain
Date: Thu, 25 Aug 2022 00:03:27 +0200	[thread overview]
Message-ID: <20220824220330.64283-12-pablo@netfilter.org> (raw)
In-Reply-To: <20220824220330.64283-1-pablo@netfilter.org>

Update nft_data_init() to report EINVAL if chain is already bound.

Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING")
Reported-by: Gwangun Jung <exsociety@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_tables_api.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 72c066a33416..2ee50e23c9b7 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -9711,6 +9711,8 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
 			return PTR_ERR(chain);
 		if (nft_is_base_chain(chain))
 			return -EOPNOTSUPP;
+		if (nft_chain_is_bound(chain))
+			return -EINVAL;
 		if (desc->flags & NFT_DATA_DESC_SETELEM &&
 		    chain->flags & NFT_CHAIN_BINDING)
 			return -EINVAL;
-- 
2.30.2


  parent reply	other threads:[~2022-08-24 22:04 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-08-24 22:03 [PATCH net 00/14] Netfilter fixes for net Pablo Neira Ayuso
2022-08-24 22:03 ` [PATCH net 01/14] netfilter: ebtables: reject blobs that don't provide all entry points Pablo Neira Ayuso
2022-08-25  2:40   ` patchwork-bot+netdevbpf
2022-08-24 22:03 ` [PATCH net 02/14] netfilter: conntrack: work around exceeded receive window Pablo Neira Ayuso
2022-08-24 22:03 ` [PATCH net 03/14] netfilter: nft_tproxy: restrict to prerouting hook Pablo Neira Ayuso
2022-08-24 22:03 ` [PATCH net 04/14] netfilter: nf_tables: disallow updates of implicit chain Pablo Neira Ayuso
2022-08-24 22:03 ` [PATCH net 05/14] netfilter: nf_tables: make table handle allocation per-netns friendly Pablo Neira Ayuso
2022-08-24 22:03 ` [PATCH net 06/14] netfilter: nft_payload: report ERANGE for too long offset and length Pablo Neira Ayuso
2022-08-24 22:03 ` [PATCH net 07/14] netfilter: nft_payload: do not truncate csum_offset and csum_type Pablo Neira Ayuso
2022-08-24 22:03 ` [PATCH net 08/14] netfilter: nf_tables: do not leave chain stats enabled on error Pablo Neira Ayuso
2022-08-24 22:03 ` [PATCH net 09/14] netfilter: nft_osf: restrict osf to ipv4, ipv6 and inet families Pablo Neira Ayuso
2022-08-24 22:03 ` [PATCH net 10/14] netfilter: nft_tunnel: restrict it to netdev family Pablo Neira Ayuso
2022-08-24 22:03 ` Pablo Neira Ayuso [this message]
2022-08-24 22:03 ` [PATCH net 12/14] netfilter: flowtable: add function to invoke garbage collection immediately Pablo Neira Ayuso
2022-08-24 22:03 ` [PATCH net 13/14] netfilter: flowtable: fix stuck flows on cleanup due to pending work Pablo Neira Ayuso
2022-08-24 22:03 ` [PATCH net 14/14] netfilter: nf_defrag_ipv6: allow nf_conntrack_frag6_high_thresh increases Pablo Neira Ayuso
2022-08-25  2:17   ` Jakub Kicinski

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220824220330.64283-12-pablo@netfilter.org \
    --to=pablo@netfilter.org \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=kuba@kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=pabeni@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.