[PATCH net 08/10] netfilter: nf_tables: fix device name and prefix match in hook lookup
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: 2026-08-21 15:39:12
Also in:
netfilter-devel
Subsystem:
netfilter, networking [general], the rest · Maintainers:
Pablo Neira Ayuso, Florian Westphal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
From: Fernando Fernandez Mancera <redacted> Currently, a netdev chain or flowtable hooked to a device prefix can be unintentionally deleted or updated by a control-plane request targeting an exact device name or even a shorter one due to the usage of min() to calculate the length to match. Fix this by making sure an exact device match never matches a prefix and that both the target and the candidate have the same length. Reported-by: Wei Fang <redacted> Closes: https://lore.kernel.org/netfilter-devel/CANE+tVrDeNCHQVmsqkV2ozeBqyE3GtRDMhZgsg1bhw10yGNTRQ@mail.gmail.com/ (local) Fixes: 6d07a289504a ("netfilter: nf_tables: Support wildcard netdev hook specs") Signed-off-by: Fernando Fernandez Mancera <redacted> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- net/netfilter/nf_tables_api.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 20c562174b27..d160f6ea0dc2 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c@@ -1978,7 +1978,7 @@ static int nft_dump_stats(struct sk_buff *skb, struct nft_stats __percpu *stats) return -ENOSPC; } -static bool hook_is_prefix(struct nft_hook *hook) +static bool hook_is_prefix(const struct nft_hook *hook) { return strlen(hook->ifname) >= hook->ifnamelen; }
@@ -2445,8 +2445,11 @@ static struct nft_hook *nft_hook_list_find(struct list_head *hook_list, struct nft_hook *hook; list_for_each_entry(hook, hook_list, list) { - if (!strncmp(hook->ifname, this->ifname, - min(hook->ifnamelen, this->ifnamelen))) { + if (hook_is_prefix(hook) != hook_is_prefix(this)) + continue; + if (hook->ifnamelen != this->ifnamelen) + continue; + if (!strncmp(hook->ifname, this->ifname, hook->ifnamelen)) { if (hook->flags & NFT_HOOK_REMOVE) continue;
--
2.47.3