netfilter: nf_tables: disallow element updates of bound anonymous sets

[linux-block.git] / net / netfilter / nf_tables_api.c

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index e2493f83c48e5e07370353680bc38169c834601c..6f26520bd865065187191a5f82b6ffdc7fb10b7a 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6668,19 +6668,19 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
        if (flags)
                *nft_set_ext_flags(ext) = flags;
 
+       if (obj) {
+               *nft_set_ext_obj(ext) = obj;
+               obj->use++;
+       }
        if (ulen > 0) {
                if (nft_set_ext_check(&tmpl, NFT_SET_EXT_USERDATA, ulen) < 0) {
                        err = -EINVAL;
-                       goto err_elem_userdata;
+                       goto err_elem_free;
                }
                udata = nft_set_ext_userdata(ext);
                udata->len = ulen - 1;
                nla_memcpy(&udata->data, nla[NFTA_SET_ELEM_USERDATA], ulen);
        }
-       if (obj) {
-               *nft_set_ext_obj(ext) = obj;
-               obj->use++;
-       }
        err = nft_set_elem_expr_setup(ctx, &tmpl, ext, expr_array, num_exprs);
        if (err < 0)
                goto err_elem_free;
@@ -6735,9 +6735,6 @@ err_set_full:
 err_element_clash:
        kfree(trans);
 err_elem_free:
-       if (obj)
-               obj->use--;
-err_elem_userdata:
        nft_set_elem_destroy(set, elem.priv, true);
 err_parse_data:
        if (nla[NFTA_SET_ELEM_DATA] != NULL)
@@ -6782,7 +6779,8 @@ static int nf_tables_newsetelem(struct sk_buff *skb,
        if (IS_ERR(set))
                return PTR_ERR(set);
 
-       if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
+       if (!list_empty(&set->bindings) &&
+           (set->flags & (NFT_SET_CONSTANT | NFT_SET_ANONYMOUS)))
                return -EBUSY;
 
        nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);
@@ -7056,7 +7054,9 @@ static int nf_tables_delsetelem(struct sk_buff *skb,
        set = nft_set_lookup(table, nla[NFTA_SET_ELEM_LIST_SET], genmask);
        if (IS_ERR(set))
                return PTR_ERR(set);
-       if (!list_empty(&set->bindings) && set->flags & NFT_SET_CONSTANT)
+
+       if (!list_empty(&set->bindings) &&
+           (set->flags & (NFT_SET_CONSTANT | NFT_SET_ANONYMOUS)))
                return -EBUSY;
 
        nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla);