From: Pablo Neira Ayuso <pablo@netfilter.org>
To: netfilter-devel@vger.kernel.org
Cc: phil@nwl.cc, fw@strlen.de
Subject: [PATCH iptables 1/6] nft: keep original cache in case of ERESTART
Date: Mon, 20 May 2019 21:08:17 +0200 [thread overview]
Message-ID: <20190520190822.18873-2-pablo@netfilter.org> (raw)
In-Reply-To: <20190520190822.18873-1-pablo@netfilter.org>
Phil Sutter says:
"The problem is that data in h->obj_list potentially sits in cache, too.
At least rules have to be there so insert with index works correctly. If
the cache is flushed before regenerating the batch, use-after-free
occurs which crashes the program."
This patch keeps around the original cache until we have refreshed the
batch.
Fixes: 862818ac3a0de ("xtables: add and use nft_build_cache")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
iptables/nft.c | 23 ++++++++++++++++++++---
iptables/nft.h | 3 ++-
2 files changed, 22 insertions(+), 4 deletions(-)
diff --git a/iptables/nft.c b/iptables/nft.c
index 172beec9ae27..288ada4af3ca 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -811,7 +811,7 @@ int nft_init(struct nft_handle *h, const struct builtin_table *t)
h->portid = mnl_socket_get_portid(h->nl);
h->tables = t;
- h->cache = &h->__cache;
+ h->cache = &h->__cache[0];
INIT_LIST_HEAD(&h->obj_list);
INIT_LIST_HEAD(&h->err_list);
@@ -1618,14 +1618,30 @@ void nft_build_cache(struct nft_handle *h)
__nft_build_cache(h);
}
-static void nft_rebuild_cache(struct nft_handle *h)
+static void __nft_flush_cache(struct nft_handle *h)
{
- if (!h->have_cache)
+ if (!h->cache_index) {
+ h->cache_index++;
+ h->cache = &h->__cache[h->cache_index];
+ } else {
flush_chain_cache(h, NULL);
+ }
+}
+
+static void nft_rebuild_cache(struct nft_handle *h)
+{
+ if (h->have_cache)
+ __nft_flush_cache(h);
__nft_build_cache(h);
}
+static void nft_release_cache(struct nft_handle *h)
+{
+ if (h->cache_index)
+ flush_cache(&h->__cache[0], h->tables, NULL);
+}
+
struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
const char *table)
{
@@ -2957,6 +2973,7 @@ retry:
batch_obj_del(h, n);
}
+ nft_release_cache(h);
mnl_batch_reset(h->batch);
if (i)
diff --git a/iptables/nft.h b/iptables/nft.h
index dc0797d302b8..43eb8a39dd9c 100644
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -48,7 +48,8 @@ struct nft_handle {
struct list_head err_list;
struct nft_family_ops *ops;
const struct builtin_table *tables;
- struct nft_cache __cache;
+ unsigned int cache_index;
+ struct nft_cache __cache[2];
struct nft_cache *cache;
bool have_cache;
bool restore;
--
2.11.0
next prev parent reply other threads:[~2019-05-20 19:08 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-20 19:08 [PATCH iptables 0/6] ERESTART fixes Pablo Neira Ayuso
2019-05-20 19:08 ` Pablo Neira Ayuso [this message]
2019-05-20 19:08 ` [PATCH iptables 2/6] xtables: Fix for explicit rule flushes Pablo Neira Ayuso
2019-05-20 19:08 ` [PATCH iptables 3/6] nft: don't skip table addition from ERESTART Pablo Neira Ayuso
2019-05-20 19:08 ` [PATCH iptables 4/6] nft: don't care about previous state in ERESTART Pablo Neira Ayuso
2019-05-20 19:08 ` [PATCH iptables 5/6] nft: do not retry on EINTR Pablo Neira Ayuso
2019-05-20 19:08 ` [PATCH iptables 6/6] nft: reset netlink sender buffer size of socket restart Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190520190822.18873-2-pablo@netfilter.org \
--to=pablo@netfilter.org \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=phil@nwl.cc \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).