netfilter: nf_tables: discard table flag update with pending basechai…

…n deletion

jira VULN-5118
cve CVE-2024-35897
commit-author Pablo Neira Ayuso <[email protected]>
commit 1bc83a0
upstream-diff The cherry pick pulled in a huge wad of upstream
code for the conflict. Resolved as best I could with 4.18.0-553.16.1
tagged code as the source of truth. In synching to the 4.18.0-553.16.1
tagged code this patch also brings in a preceding empty commit.  I know
of no good way to do this but I want to document that the code for both
of these commits is in place in this patch. If you're confused, so am I.
This is the empty preceding commit:

    netfilter: nf_tables: reject table flag and netdev basechain updates

    jira VULN-5118
    subsystem-sync netfilter:nf_tables 4.18.0-553.16.1
    commit-author Pablo Neira Ayuso <[email protected]>
    commit 1e1fb6f

    netdev basechain updates are stored in the transaction object hook list.
    When setting on the table dormant flag, it iterates over the existing
    hooks in the basechain. Thus, skipping the hooks that are being
    added/deleted in this transaction, which leaves hook registration in
    inconsistent state.

    Reject table flag updates in combination with netdev basechain updates
    in the same batch:

    - Update table flags and add/delete basechain: Check from basechain update
      path if there are pending flag updates for this table.
    - add/delete basechain and update table flags: Iterate over the transaction
      list to search for basechain updates from the table update path.

    In both cases, the batch is rejected. Based on suggestion from Florian Westphal.

    Fixes: b9703ed ("netfilter: nf_tables: support for adding new devices to an existing netdev chain")
    Fixes: 7d937b1 ("netfilter: nf_tables: support for deleting devices in an existing netdev chain")
            Signed-off-by: Pablo Neira Ayuso <[email protected]>
    (cherry picked from commit 1e1fb6f)
            Signed-off-by: Greg Rose <[email protected]>
------ End preceding empty commit

Hook unregistration is deferred to the commit phase, same occurs with
hook updates triggered by the table dormant flag. When both commands are
combined, this results in deleting a basechain while leaving its hook
still registered in the core.

Fixes: 179d9ba ("netfilter: nf_tables: fix table flag updates")
	Signed-off-by: Pablo Neira Ayuso <[email protected]>

Conflicts:
	net/netfilter/nf_tables_api.c

net/netfilter/nf_tables_api.c

@@ -954,6 +954,25 @@ static void nf_tables_table_disable(struct net *net, struct nft_table *table)
 #define __NFT_TABLE_F_UPDATE		(__NFT_TABLE_F_WAS_DORMANT | \
 					 __NFT_TABLE_F_WAS_AWAKEN)
 
+static bool nft_table_pending_update(const struct nft_ctx *ctx)
+{
+	struct nft_trans *trans;
+
+	if (ctx->table->flags & __NFT_TABLE_F_UPDATE)
+		return true;
+
+        list_for_each_entry(trans, &ctx->net->nft.commit_list, list) {
+                if (trans->ctx.table == ctx->table &&
+                    ((trans->msg_type == NFT_MSG_NEWCHAIN &&
+                      nft_trans_chain_update(trans)) ||
+                     (trans->msg_type == NFT_MSG_DELCHAIN &&
+                      nft_is_base_chain(trans->ctx.chain))))
+                        return true;
+        }
+
+	return false;
+}
+
 static int nf_tables_updtable(struct nft_ctx *ctx)
 {
 	struct nft_trans *trans;
@@ -971,7 +990,7 @@ static int nf_tables_updtable(struct nft_ctx *ctx)
 		return 0;
 
 	/* No dormant off/on/off/on games in single transaction */
-	if (ctx->table->flags & __NFT_TABLE_F_UPDATE)
+	if (nft_table_pending_update(ctx))
 		return -EINVAL;
 
 	trans = nft_trans_alloc(ctx, NFT_MSG_NEWTABLE,