netfilter: nf_tables: do not update stateful expressions if lookup is inverted

Initialize set lookup matching element to NULL. Otherwise, the
NFT_LOOKUP_F_INV flag reverses the matching logic and it leads to
deference an uninitialized pointer to the matching element. Make sure
element data area and stateful expression are accessed if there is a
matching set element.

This patch undoes 24791b9aa1ab ("netfilter: nft_set_bitmap: initialize set
element extension in lookups") which is not required anymore.

Fixes: 339706bc21c1 ("netfilter: nft_lookup: update element stateful expression")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 6eb627b3c99b6f8cbd10a2af131489a26e83e579..4ff7c81e6717b6f12eeca46d6e0d7df110958dfe 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -901,7 +901,7 @@ static inline void nft_set_elem_update_expr(const struct nft_set_ext *ext,
 {
        struct nft_expr *expr;
 
-       if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR)) {
+       if (__nft_set_ext_exists(ext, NFT_SET_EXT_EXPR)) {
                expr = nft_set_ext_expr(ext);
                expr->ops->eval(expr, regs, pkt);
        }

diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
index 1e70359d633c0eac04745860a9deb6bfd2f2c6df..f1363b8aabba84a63170fc84dbeeff132d58276c 100644 (file)
--- a/net/netfilter/nft_lookup.c
+++ b/net/netfilter/nft_lookup.c
@@ -29,7 +29,7 @@ void nft_lookup_eval(const struct nft_expr *expr,
 {
        const struct nft_lookup *priv = nft_expr_priv(expr);
        const struct nft_set *set = priv->set;
-       const struct nft_set_ext *ext;
+       const struct nft_set_ext *ext = NULL;
        bool found;
 
        found = set->ops->lookup(nft_net(pkt), set, &regs->data[priv->sreg],
@@ -39,11 +39,13 @@ void nft_lookup_eval(const struct nft_expr *expr,
                return;
        }
 
-       if (set->flags & NFT_SET_MAP)
-               nft_data_copy(&regs->data[priv->dreg],
-                             nft_set_ext_data(ext), set->dlen);
+       if (ext) {
+               if (set->flags & NFT_SET_MAP)
+                       nft_data_copy(&regs->data[priv->dreg],
+                                     nft_set_ext_data(ext), set->dlen);
 
-       nft_set_elem_update_expr(ext, regs, pkt);
+               nft_set_elem_update_expr(ext, regs, pkt);
+       }
 }
 
 static const struct nla_policy nft_lookup_policy[NFTA_LOOKUP_MAX + 1] = {

diff --git a/net/netfilter/nft_set_bitmap.c b/net/netfilter/nft_set_bitmap.c
index 32f0fc8be3a4c475f85595bf1fadba92afa600ea..2a81ea4218193aac5ae82a38d770572509c6d14e 100644 (file)
--- a/net/netfilter/nft_set_bitmap.c
+++ b/net/netfilter/nft_set_bitmap.c
@@ -81,7 +81,6 @@ static bool nft_bitmap_lookup(const struct net *net, const struct nft_set *set,
        u32 idx, off;
 
        nft_bitmap_location(set, key, &idx, &off);
-       *ext = NULL;
 
        return nft_bitmap_active(priv->bitmap, idx, off, genmask);
 }