Patch "netfilter: nf_tables: fix set->nelems counting with no NLM_F_EXCL" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

    netfilter: nf_tables: fix set->nelems counting with no NLM_F_EXCL

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
netfilter-nf_tables-fix-set-nelems-counting-with-no-nlm_f_excl.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Pablo Neira Ayuso <[email protected]>
Date: Tue, 24 Jan 2017 00:51:32 +0100
Subject: netfilter: nf_tables: fix set->nelems counting with no NLM_F_EXCL

From: Pablo Neira Ayuso <[email protected]>

[ Upstream commit 35d0ac9070ef619e3bf44324375878a1c540387b ]

If the element exists and no NLM_F_EXCL is specified, do not bump set->nelems, otherwise we leak one set element slot. This problem amplifies if the set is full since the abort path always decrements the counter for the -ENFILE case too, giving one spare extra slot.

Fix this by moving set->nelems update to nft_add_set_elem() after successful element insertion. Moreover, remove the element if the set is full so there is no need to rely on the abort path to undo things anymore.

---
 net/netfilter/nf_tables_api.c |   16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

@@ -3637,10 +3637,18 @@ static int nft_add_set_elem(struct nft_c
 		goto err5;
 	}
 
+	if (set->size &&
+	    !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact)) {
+		err = -ENFILE;
+		goto err6;
+	}
+
 	nft_trans_elem(trans) = elem;
 	list_add_tail(&trans->list, &ctx->net->nft.commit_list);
 	return 0;
 
+err6:
+	set->ops->remove(set, &elem);
 err5:
 	kfree(trans);
 err4:

@@ -3687,15 +3695,9 @@ static int nf_tables_newsetelem(struct n
 		return -EBUSY;
 
 	nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
-		if (set->size &&
-		    !atomic_add_unless(&set->nelems, 1, set->size + set->ndeact))
-			return -ENFILE;
-
 		err = nft_add_set_elem(&ctx, set, attr, nlh->nlmsg_flags);
-		if (err < 0) {
-			atomic_dec(&set->nelems);
+		if (err < 0)
 			break;
-		}
 	}
 	return err;
 }

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/netfilter-nft_log-restrict-the-log-prefix-length-to-127.patch queue-4.9/gtp-add-genl-family-modules-alias.patch queue-4.9/netfilter-nf_conntrack_sip-fix-wrong-memory-initialisation.patch queue-4.9/netfilter-nf_tables-fix-set-nelems-counting-with-no-nlm_f_excl.patch