diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-05-19 18:58:40 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-05-20 20:56:47 +0200 |
commit | f6ad231d698c7c091371264d8d1881cbb9cf0ba1 (patch) | |
tree | 9d3d5edbf6e58189566aab376f7ad9112cf6e167 /iptables | |
parent | ab1cd3b510fa5d5642b8698c5bd5c125b53ff7c7 (diff) |
nft: keep original cache in case of ERESTART
Phil Sutter says:
"The problem is that data in h->obj_list potentially sits in cache, too.
At least rules have to be there so insert with index works correctly. If
the cache is flushed before regenerating the batch, use-after-free
occurs which crashes the program."
This patch keeps around the original cache until we have refreshed the
batch.
Fixes: 862818ac3a0de ("xtables: add and use nft_build_cache")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'iptables')
-rw-r--r-- | iptables/nft.c | 23 | ||||
-rw-r--r-- | iptables/nft.h | 3 |
2 files changed, 22 insertions, 4 deletions
diff --git a/iptables/nft.c b/iptables/nft.c index 172beec9..288ada4a 100644 --- a/iptables/nft.c +++ b/iptables/nft.c @@ -811,7 +811,7 @@ int nft_init(struct nft_handle *h, const struct builtin_table *t) h->portid = mnl_socket_get_portid(h->nl); h->tables = t; - h->cache = &h->__cache; + h->cache = &h->__cache[0]; INIT_LIST_HEAD(&h->obj_list); INIT_LIST_HEAD(&h->err_list); @@ -1618,14 +1618,30 @@ void nft_build_cache(struct nft_handle *h) __nft_build_cache(h); } -static void nft_rebuild_cache(struct nft_handle *h) +static void __nft_flush_cache(struct nft_handle *h) { - if (!h->have_cache) + if (!h->cache_index) { + h->cache_index++; + h->cache = &h->__cache[h->cache_index]; + } else { flush_chain_cache(h, NULL); + } +} + +static void nft_rebuild_cache(struct nft_handle *h) +{ + if (h->have_cache) + __nft_flush_cache(h); __nft_build_cache(h); } +static void nft_release_cache(struct nft_handle *h) +{ + if (h->cache_index) + flush_cache(&h->__cache[0], h->tables, NULL); +} + struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h, const char *table) { @@ -2957,6 +2973,7 @@ retry: batch_obj_del(h, n); } + nft_release_cache(h); mnl_batch_reset(h->batch); if (i) diff --git a/iptables/nft.h b/iptables/nft.h index dc0797d3..43eb8a39 100644 --- a/iptables/nft.h +++ b/iptables/nft.h @@ -48,7 +48,8 @@ struct nft_handle { struct list_head err_list; struct nft_family_ops *ops; const struct builtin_table *tables; - struct nft_cache __cache; + unsigned int cache_index; + struct nft_cache __cache[2]; struct nft_cache *cache; bool have_cache; bool restore; |