diff mbox series

[SRU,Mantic,Jammy,1/1] netfilter: nf_tables: check if catch-all set element is active in next generation

Message ID 20240221190748.53029-2-bethany.jamison@canonical.com
State New
Headers show
Series CVE-2024-1085 | expand

Commit Message

Bethany Jamison Feb. 21, 2024, 7:07 p.m. UTC 
From: Pablo Neira Ayuso <pablo@netfilter.org>

When deactivating the catch-all set element, check the state in the next
generation that represents this transaction.

This bug uncovered after the recent removal of the element busy mark
a2dd0233cbc4 ("netfilter: nf_tables: remove busy mark and gc batch API").

Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support")
Cc: stable@vger.kernel.org
Reported-by: lonial con <kongln9170@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
(cherry picked from commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7)
CVE-2024-1085
Signed-off-by: Bethany Jamison <bethany.jamison@canonical.com>
---
 net/netfilter/nf_tables_api.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 6b9eea5cc58d4..9810d98860389 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6419,7 +6419,7 @@  static int nft_setelem_catchall_deactivate(const struct net *net,
 
 	list_for_each_entry(catchall, &set->catchall_list, list) {
 		ext = nft_set_elem_ext(set, catchall->elem);
-		if (!nft_is_active(net, ext))
+		if (!nft_is_active_next(net, ext))
 			continue;
 
 		kfree(elem->priv);