[PATCH iptables RFC 2/4] nft: keep original cache in case of ERESTART

[Pablo Neira Ayuso]

Phil Sutter says:

"The problem is that data in h->obj_list potentially sits in cache, too.
At least rules have to be there so insert with index works correctly. If
the cache is flushed before regenerating the batch, use-after-free
occurs which crashes the program."

This patch keeps around the original cache until we have refreshed the
batch.

Fixes: 862818ac3a0de ("xtables: add and use nft_build_cache")
Signed-off-by: Pablo Neira Ayuso <pa...@netfilter.org>
---
 iptables/nft.c | 25 +++++++++++++++++++++----
 iptables/nft.h |  3 ++-
 2 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/iptables/nft.c b/iptables/nft.c
index 0f0492bc200c..a03a84c9a6d1 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -811,7 +811,7 @@ int nft_init(struct nft_handle *h, const struct 
builtin_table *t)
 
        h->portid = mnl_socket_get_portid(h->nl);
        h->tables = t;
-       h->cache = &h->__cache;
+       h->cache = &h->__cache[0];
 
        INIT_LIST_HEAD(&h->obj_list);
        INIT_LIST_HEAD(&h->err_list);
@@ -1618,14 +1618,30 @@ void nft_build_cache(struct nft_handle *h)
                __nft_build_cache(h);
 }
 
-static void nft_rebuild_cache(struct nft_handle *h)
+static void __nft_flush_cache(struct nft_handle *h)
 {
-       if (!h->have_cache)
+       if (!h->cache_index) {
+               h->cache_index++;
+               h->cache = &h->__cache[h->cache_index];
+       } else {
                flush_chain_cache(h, NULL);
+       }
+}
+
+static void nft_rebuild_cache(struct nft_handle *h)
+{
+       if (h->have_cache)
+               __nft_flush_cache(h);
 
        __nft_build_cache(h);
 }
 
+static void nft_release_cache(struct nft_handle *h)
+{
+       if (h->cache_index)
+               flush_cache(&h->__cache[0], h->tables, NULL);
+}
+
 struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
                                            const char *table)
 {
@@ -1762,7 +1778,7 @@ __nft_rule_flush(struct nft_handle *h, const char *table,
                return;
        }
 
-       obj->implicit = 1;
+       obj->implicit = implicit;
 }
 
 int nft_rule_flush(struct nft_handle *h, const char *chain, const char *table,
@@ -2950,6 +2966,7 @@ retry:
                batch_obj_del(h, n);
        }
 
+       nft_release_cache(h);
        mnl_batch_reset(h->batch);
 
        if (i)
diff --git a/iptables/nft.h b/iptables/nft.h
index dc0797d302b8..43eb8a39dd9c 100644
--- a/iptables/nft.h
+++ b/iptables/nft.h
@@ -48,7 +48,8 @@ struct nft_handle {
        struct list_head        err_list;
        struct nft_family_ops   *ops;
        const struct builtin_table *tables;
-       struct nft_cache        __cache;
+       unsigned int            cache_index;
+       struct nft_cache        __cache[2];
        struct nft_cache        *cache;
        bool                    have_cache;
        bool                    restore;
-- 
2.11.0