summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPablo Neira Ayuso <pablo@netfilter.org>2019-05-19 18:58:40 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2019-05-20 20:56:47 +0200
commitf6ad231d698c7c091371264d8d1881cbb9cf0ba1 (patch)
tree9d3d5edbf6e58189566aab376f7ad9112cf6e167
parentab1cd3b510fa5d5642b8698c5bd5c125b53ff7c7 (diff)
nft: keep original cache in case of ERESTART
Phil Sutter says: "The problem is that data in h->obj_list potentially sits in cache, too. At least rules have to be there so insert with index works correctly. If the cache is flushed before regenerating the batch, use-after-free occurs which crashes the program." This patch keeps around the original cache until we have refreshed the batch. Fixes: 862818ac3a0de ("xtables: add and use nft_build_cache") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
-rw-r--r--iptables/nft.c23
-rw-r--r--iptables/nft.h3
2 files changed, 22 insertions, 4 deletions
diff --git a/iptables/nft.c b/iptables/nft.c
index 172beec9..288ada4a 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -811,7 +811,7 @@ int nft_init(struct nft_handle *h, const struct builtin_table *t)
h->portid = mnl_socket_get_portid(h->nl);
h->tables = t;
- h->cache = &h->__cache;
+ h->cache = &h->__cache[0];
INIT_LIST_HEAD(&h->obj_list);
INIT_LIST_HEAD(&h->err_list);
@@ -1618,14 +1618,30 @@ void nft_build_cache(struct nft_handle *h)
__nft_build_cache(h);
}
-static void nft_rebuild_cache(struct nft_handle *h)
+static void __nft_flush_cache(struct nft_handle *h)
{
- if (!h->have_cache)
+ if (!h->cache_index) {
+ h->cache_index++;
+ h->cache = &h->__cache[h->cache_index];
+ } else {
flush_chain_cache(h, NULL);
+ }
+}
+
+static void nft_rebuild_cache(struct nft_handle *h)
+{
+ if (h->have_cache)
+ __nft_flush_cache(h);
__nft_build_cache(h);
}
+static void nft_release_cache(struct nft_handle *h)
+{
+ if (h->cache_index)
+ flush_cache(&h->__cache[0], h->tables, NULL);
+}
+
struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
const char *table)
{
@@ -2957,6 +2973,7 @@ retry:
batch_obj_del(h, n);
}
+ nft_release_cache(h);
mnl_batch_reset(h->batch);
if (i)
diff --git a/iptables/nft.h b/iptables/nft.h
index dc0797d3..43eb8a39 100644
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -48,7 +48,8 @@ struct nft_handle {
struct list_head err_list;
struct nft_family_ops *ops;
const struct builtin_table *tables;
- struct nft_cache __cache;
+ unsigned int cache_index;
+ struct nft_cache __cache[2];
struct nft_cache *cache;
bool have_cache;
bool restore;