netfilter: nf_tables: disallow element removal on anonymous sets

[ Upstream commit 23a3bfd4ba7acd36abf52b78605f61b21bdac216 ]

Anonymous sets need to be populated once at creation and then they are
bound to rule since 938154b93be8 ("netfilter: nf_tables: reject unbound
anonymous set before commit phase"), otherwise transaction reports
EINVAL.

Userspace does not need to delete elements of anonymous sets that are
not yet bound, reject this with EOPNOTSUPP.

From flush command path, skip anonymous sets, they are expected to be
bound already. Otherwise, EINVAL is hit at the end of this transaction
for unbound sets.

Fixes: 96518518cc41 ("netfilter: add nftables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index b22f2d9ee4afc0f5158fa315a276102d72dd0df7..521f8c3cb69877e00f19ef20830c8c41e2eaadc1 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1437,8 +1437,7 @@ static int nft_flush_table(struct nft_ctx *ctx)
                if (!nft_is_active_next(ctx->net, set))
                        continue;
 
-               if (nft_set_is_anonymous(set) &&
-                   !list_empty(&set->bindings))
+               if (nft_set_is_anonymous(set))
                        continue;
 
                err = nft_delset(ctx, set);
@@ -6907,8 +6906,10 @@ static int nf_tables_delsetelem(struct sk_buff *skb,
        if (IS_ERR(set))
                return PTR_ERR(set);
 
-       if (!list_empty(&set->bindings) &&
-           (set->flags & (NFT_SET_CONSTANT | NFT_SET_ANONYMOUS)))
+       if (nft_set_is_anonymous(set))
+               return -EOPNOTSUPP;
+
+       if (!list_empty(&set->bindings) && (set->flags & NFT_SET_CONSTANT))
                return -EBUSY;
 
        nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);