netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain

Browse source

[ Upstream commit 26b5a5712e ]

Add a new state to deal with rule expressions deactivation from the
newrule error path, otherwise the anonymous set remains in the list in
inactive state for the next generation. Mark the set/chain transaction
as unbound so the abort path releases this object, set it as inactive in
the next generation so it is not reachable anymore from this transaction
and reference counter is dropped.

Fixes: 1240eb93f0 ("netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Pablo Neira Ayuso 2023-06-16 14:45:26 +02:00 • committed by Greg Kroah-Hartman

parent 891cd2eddd

commit df27be7c15

3 changed files with 43 additions and 7 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

include/net/netfilter/nf_tables.h

View file

45

net/netfilter/nf_tables_api.c

View file

3

net/netfilter/nft_immediate.c

View file