[PATCH net 2/4] netfilter: nf_tables: fix device name and prefix match in hook lookup

COLD20d

From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: 2026-09-13 20:55:05
Also in: netfilter-devel
Subsystem: netfilter, networking [general], the rest · Maintainers: Pablo Neira Ayuso, Florian Westphal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds

Revision v2 of 221 in this series.

Revisions (221)

2012-11-22 v1 [diff vs current]
2013-02-26 v1 [diff vs current]
2013-04-12 v1 [diff vs current]
2013-04-19 v1 [diff vs current]
2013-06-17 v1 [diff vs current]
2013-09-17 v1 [diff vs current]
2013-10-23 v1 [diff vs current]
2013-11-21 v1 [diff vs current]
2013-12-07 v1 [diff vs current]
2014-01-07 v1 [diff vs current]
2014-02-19 v1 [diff vs current]
2014-04-14 v1 [diff vs current]
2014-05-09 v1 [diff vs current]
2014-06-18 v1 [diff vs current]
2014-08-11 v1 [diff vs current]
2014-10-27 v1 [diff vs current]
2014-11-20 v1 [diff vs current]
2015-03-22 v1 [diff vs current]
2015-04-27 v1 [diff vs current]
2015-05-22 v1 [diff vs current]
2015-07-08 v1 [diff vs current]
2015-08-10 v1 [diff vs current]
2015-10-19 v1 [diff vs current]
2015-11-04 v1 [diff vs current]
2015-12-14 v1 [diff vs current]
2015-12-22 v1 [diff vs current]
2016-01-20 v1 [diff vs current]
2016-02-16 v1 [diff vs current]
2016-06-01 v1 [diff vs current]
2016-06-17 v1 [diff vs current]
2016-08-10 v1 [diff vs current]
2016-08-10 v1 [diff vs current]
2016-09-13 v1 [diff vs current]
2016-10-21 v1 [diff vs current]
2016-11-10 v1 [diff vs current]
2016-11-30 v1 [diff vs current]
2017-01-26 v1 [diff vs current]
2017-02-23 v1 [diff vs current]
2017-02-27 v1 [diff vs current]
2017-03-29 v1 [diff vs current]
2017-04-14 v1 [diff vs current]
2017-07-06 v1 [diff vs current]
2017-07-18 v1 [diff vs current]
2017-08-24 v1 [diff vs current]
2017-09-20 v1 [diff vs current]
2017-11-01 v1 [diff vs current]
2017-12-13 v1 [diff vs current]
2018-01-05 v1 [diff vs current]
2018-02-01 v1 [diff vs current]
2018-02-20 v1 [diff vs current]
2018-03-12 v1 [diff vs current]
2018-06-13 v1 [diff vs current]
2018-06-27 v1 [diff vs current]
2018-07-09 v1 [diff vs current]
2018-07-24 v1 [diff vs current]
2018-09-11 v1 [diff vs current]
2018-10-02 v1 [diff vs current]
2018-11-06 v1 [diff vs current]
2018-11-28 v1 [diff vs current]
2018-12-13 v1 [diff vs current]
2018-12-29 v1 [diff vs current]
2019-01-14 v1 [diff vs current]
2019-02-05 v1 [diff vs current]
2019-02-11 v1 [diff vs current]
2019-03-11 v1 [diff vs current]
2019-03-21 v1 [diff vs current]
2019-05-13 v1 [diff vs current]
2019-06-17 v1 [diff vs current]
2019-07-19 v1 [diff vs current]
2019-07-31 v1 [diff vs current]
2019-08-14 v1 [diff vs current]
2019-08-19 v1 [diff vs current]
2019-08-30 v1 [diff vs current]
2019-09-04 v1 [diff vs current]
2019-09-25 v1 [diff vs current]
2019-11-06 v1 [diff vs current]
2019-12-09 v1 [diff vs current]
2019-12-26 v1 [diff vs current]
2020-01-08 v1 [diff vs current]
2020-01-25 v1 [diff vs current]
2020-01-31 v1 [diff vs current]
2020-02-18 v1 [diff vs current]
2020-02-26 v1 [diff vs current]
2020-03-06 v1 [diff vs current]
2020-04-07 v1 [diff vs current]
2020-04-29 v1 [diff vs current]
2020-05-14 v1 [diff vs current]
2020-05-25 v1 [diff vs current]
2020-05-27 v1 [diff vs current]
2020-06-14 v1 [diff vs current]
2020-06-25 v1 [diff vs current]
2020-07-04 v1 [diff vs current]
2020-08-04 v1 [diff vs current]
2020-08-15 v1 [diff vs current]
2020-08-24 v1 [diff vs current]
2020-08-31 v1 [diff vs current]
2020-10-13 v1 [diff vs current]
2020-10-22 v1 [diff vs current]
2020-10-31 v1 [diff vs current]
2020-11-21 v1 [diff vs current]
2020-12-09 v1 [diff vs current]
2020-12-18 v1 [diff vs current]
2021-01-03 v1 [diff vs current]
2021-02-05 v1 [diff vs current]
2021-03-19 v1 [diff vs current]
2021-04-12 v1 [diff vs current]
2021-05-07 v1 [diff vs current]
2021-05-14 v1 [diff vs current]
2021-06-02 v1 [diff vs current]
2021-06-10 v1 [diff vs current]
2021-06-22 v1 [diff vs current]
2021-07-07 v1 [diff vs current]
2021-07-23 v1 [diff vs current]
2021-08-06 v1 [diff vs current]
2021-08-06 v2 [diff vs current]
2021-09-03 v1 [diff vs current]
2021-09-29 v1 [diff vs current]
2021-11-18 v1 [diff vs current]
2021-12-09 v1 [diff vs current]
2021-12-17 v1 [diff vs current]
2022-01-06 v1 [diff vs current]
2022-01-20 v1 [diff vs current]
2022-01-27 v1 [diff vs current]
2022-02-04 v1 [diff vs current]
2022-02-10 v1 [diff vs current]
2022-02-22 v2 [diff vs current]
2022-03-01 v1 [diff vs current]
2022-03-12 v1 [diff vs current]
2022-03-17 v1 [diff vs current]
2022-03-28 v1 [diff vs current]
2022-04-05 v1 [diff vs current]
2022-04-12 v1 [diff vs current]
2022-04-28 v1 [diff vs current]
2022-05-18 v1 [diff vs current]
2022-05-26 v1 [diff vs current]
2022-05-27 v1 [diff vs current]
2022-05-31 v1 [diff vs current]
2022-06-06 v1 [diff vs current]
2022-06-21 v1 [diff vs current]
2022-06-29 v1 [diff vs current]
2022-07-02 v1 [diff vs current]
2022-07-11 v1 [diff vs current]
2022-08-09 v1 [diff vs current]
2022-08-24 v1 [diff vs current]
2022-10-19 v1 [diff vs current]
2022-11-09 v1 [diff vs current]
2022-11-18 v1 [diff vs current]
2022-11-22 v1 [diff vs current]
2022-11-30 v1 [diff vs current]
2023-01-02 v1 [diff vs current]
2023-01-13 v1 [diff vs current]
2023-01-23 v1 [diff vs current]
2023-01-24 v1 [diff vs current]
2023-01-31 v1 [diff vs current]
2023-03-07 v1 [diff vs current]
2023-03-09 v1 [diff vs current]
2023-04-20 v1 [diff vs current]
2023-04-21 v1 [diff vs current]
2023-05-03 v1 [diff vs current]
2023-06-06 v1 [diff vs current]
2023-06-08 v1 [diff vs current]
2023-06-27 v1 [diff vs current]
2023-07-05 v1 [diff vs current]
2023-08-10 v1 [diff vs current]
2023-08-30 v1 [diff vs current]
2023-09-13 v1 [diff vs current]
2023-10-25 v1 [diff vs current]
2023-12-06 v1 [diff vs current]
2023-12-20 v1 [diff vs current]
2023-12-22 v1 [diff vs current]
2024-01-03 v1 [diff vs current]
2024-01-17 v1 [diff vs current]
2024-01-18 v2 [diff vs current]
2024-01-24 v1 [diff vs current]
2024-01-31 v1 [diff vs current]
2024-02-08 v2 [diff vs current]
2024-02-14 v1 [diff vs current]
2024-02-22 v1 [diff vs current]
2024-02-29 v1 [diff vs current]
2024-03-07 v1 [diff vs current]
2024-03-21 v2 [diff vs current]
2024-03-28 v1 [diff vs current]
2024-04-04 v1 [diff vs current]
2024-04-11 v1 [diff vs current]
2024-04-18 v1 [diff vs current]
2024-05-22 v1 [diff vs current]
2024-05-28 v3 [diff vs current]
2024-06-11 v1 [diff vs current]
2024-06-19 v1 [diff vs current]
2024-06-26 v1 [diff vs current]
2024-07-11 v1 [diff vs current]
2024-07-31 v1 [diff vs current]
2024-08-14 v1 [diff vs current]
2024-08-22 v1 [diff vs current]
2024-08-28 v1 [diff vs current]
2024-09-24 v1 [diff vs current]
2024-09-26 v2 [diff vs current]
2024-10-02 v1 [diff vs current]
2024-10-09 v1 [diff vs current]
2024-10-31 v1 [diff vs current]
2024-11-28 v1 [diff vs current]
2024-11-28 v2 [diff vs current]
2024-12-05 v1 [diff vs current]
2024-12-11 v1 [diff vs current]
2025-04-03 v1 [diff vs current]
2025-04-10 v1 [diff vs current]
2025-06-05 v1 [diff vs current]
2025-07-17 v1 [diff vs current]
2025-08-07 v1 [diff vs current]
2026-03-25 v2 [diff vs current]
2026-04-01 v1 [diff vs current]
2026-04-28 v2 [diff vs current]
2026-05-01 v1 [diff vs current]
2026-05-07 v1 [diff vs current]
2026-06-10 v1 [diff vs current]
2026-06-19 v1 [diff vs current]
2026-06-20 v2 [diff vs current]
2026-06-23 v1 [diff vs current]
2026-08-21 v1 [diff vs current]
2026-08-27 v2 [diff vs current]
2026-09-13 v2 current

From: Fernando Fernandez Mancera <redacted>

Currently, a netdev chain or flowtable hooked to a device prefix can be
unintentionally deleted by a control-plane request targeting an exact
device name or even a shorter one due to the usage of min() to calculate
the length to match.

Fix this by making sure an exact device match never matches a prefix and
that both the target and the candidate have the same length during
delete operation. The add and update paths retain the existing overlap
matching to prevent a single device from matching multiple hooks.

Reported-by: Wei Fang <redacted>
Closes: https://lore.kernel.org/netfilter-devel/CANE+tVrDeNCHQVmsqkV2ozeBqyE3GtRDMhZgsg1bhw10yGNTRQ@mail.gmail.com/ (local)
Fixes: 6d07a289504a ("netfilter: nf_tables: Support wildcard netdev hook specs")
Signed-off-by: Fernando Fernandez Mancera <redacted>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_tables_api.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 31fbd5a28937..c0b754a2d45b 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c

@@ -2440,11 +2440,14 @@ static struct nft_hook *nft_netdev_hook_alloc(struct net *net,
 }
 
 static struct nft_hook *nft_hook_list_find(struct list_head *hook_list,
-					   const struct nft_hook *this)
+					   const struct nft_hook *this,
+					   bool strict)
 {
 	struct nft_hook *hook;
 
 	list_for_each_entry(hook, hook_list, list) {
+		if (strict && hook->ifnamelen != this->ifnamelen)
+			continue;
 		if (!strncmp(hook->ifname, this->ifname,
 			     min(hook->ifnamelen, this->ifnamelen))) {
 			if (hook->flags & NFT_HOOK_REMOVE)

@@ -2486,7 +2489,7 @@ static int nf_tables_parse_netdev_hooks(struct net *net,
 			err = PTR_ERR(hook);
 			goto err_hook;
 		}
-		if (nft_hook_list_find(hook_list, hook)) {
+		if (nft_hook_list_find(hook_list, hook, false)) {
 			NL_SET_BAD_ATTR(extack, tmp);
 			nft_netdev_hook_free(hook);
 			err = -EEXIST;

@@ -2943,7 +2946,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
 					ops->hook	= basechain->ops.hook;
 				}
 
-				if (nft_hook_list_find(&basechain->hook_list, h)) {
+				if (nft_hook_list_find(&basechain->hook_list, h, false)) {
 					list_del(&h->list);
 					nft_netdev_hook_free(h);
 					continue;

@@ -2956,7 +2959,8 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
 					    !nft_trans_chain_update(trans))
 						continue;
 
-					if (nft_hook_list_find(&nft_trans_chain_hooks(trans), h)) {
+					if (nft_hook_list_find(&nft_trans_chain_hooks(trans),
+							       h, false)) {
 						nft_chain_release_hook(&hook);
 						return -EEXIST;
 					}

@@ -3257,7 +3261,7 @@ static int nft_delchain_hook(struct nft_ctx *ctx,
 		return err;
 
 	list_for_each_entry(this, &chain_hook.list, list) {
-		hook = nft_hook_list_find(&basechain->hook_list, this);
+		hook = nft_hook_list_find(&basechain->hook_list, this, true);
 		if (!hook) {
 			err = -ENOENT;
 			goto err_chain_del_hook;

@@ -9053,7 +9057,7 @@ static int nft_register_flowtable_net_hooks(struct net *net,
 			if (!nft_is_active_next(net, ft))
 				continue;
 
-			if (nft_hook_list_find(&ft->hook_list, hook)) {
+			if (nft_hook_list_find(&ft->hook_list, hook, false)) {
 				err = -EEXIST;
 				goto err_unregister_net_hooks;
 			}

@@ -9130,7 +9134,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
 		return err;
 
 	list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) {
-		if (nft_hook_list_find(&flowtable->hook_list, hook)) {
+		if (nft_hook_list_find(&flowtable->hook_list, hook, false)) {
 			list_del(&hook->list);
 			nft_netdev_hook_free(hook);
 			continue;

@@ -9143,7 +9147,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
 			    !nft_trans_flowtable_update(trans))
 				continue;
 
-			if (nft_hook_list_find(&nft_trans_flowtable_hooks(trans), hook)) {
+			if (nft_hook_list_find(&nft_trans_flowtable_hooks(trans), hook, false)) {
 				err = -EEXIST;
 				goto err_flowtable_update_hook;
 			}

@@ -9363,7 +9367,7 @@ static int nft_delflowtable_hook(struct nft_ctx *ctx,
 		return err;
 
 	list_for_each_entry(this, &flowtable_hook.list, list) {
-		hook = nft_hook_list_find(&flowtable->hook_list, this);
+		hook = nft_hook_list_find(&flowtable->hook_list, this, true);
 		if (!hook) {
 			err = -ENOENT;
 			goto err_flowtable_del_hook;

-- 
2.47.3

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help