netfilter: nf_tables: validate chain type update if available
authorPablo Neira Ayuso <pablo@netfilter.org>
Thu, 14 Dec 2023 21:43:22 +0000 (22:43 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 25 Jan 2024 23:35:29 +0000 (15:35 -0800)
commitf1ee0ffbc0243f0a9dc4a9348fffed710d9ea419
treeb65e243c8949324bd0ca48c1cf6308699bd7a535
parentf5ab4e73c9e10b87e8d3066ac227bfcd70a80136
netfilter: nf_tables: validate chain type update if available

[ Upstream commit aaba7ddc8507f4ad5bbd07988573967632bc2385 ]

Parse netlink attribute containing the chain type in this update, to
bail out if this is different from the existing type.

Otherwise, it is possible to define a chain with the same name, hook and
priority but different type, which is silently ignored.

Fixes: 96518518cc41 ("netfilter: add nftables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/netfilter/nf_tables_api.c