netfilter: nf_tables: fix spurious set element insertion failure

JIRA: https://issues.redhat.com/browse/RHEL-1720
JIRA: https://issues.redhat.com/browse/RHEL-1721
Upstream Status: commit ddbd8be

commit ddbd8be
Author: Florian Westphal <fw@strlen.de>
Date:   Thu Jul 20 00:29:58 2023 +0200

    netfilter: nf_tables: fix spurious set element insertion failure

    On some platforms there is a padding hole in the nft_verdict
    structure, between the verdict code and the chain pointer.

    On element insertion, if the new element clashes with an existing one and
    NLM_F_EXCL flag isn't set, we want to ignore the -EEXIST error as long as
    the data associated with duplicated element is the same as the existing
    one.  The data equality check uses memcmp.

    For normal data (NFT_DATA_VALUE) this works fine, but for NFT_DATA_VERDICT
    padding area leads to spurious failure even if the verdict data is the
    same.

    This then makes the insertion fail with 'already exists' error, even
    though the new "key : data" matches an existing entry and userspace
    told the kernel that it doesn't want to receive an error indication.

    Fixes: c016c7e ("netfilter: nf_tables: honor NLM_F_EXCL flag in set element insertion")
    Signed-off-by: Florian Westphal <fw@strlen.de>

Signed-off-by: Florian Westphal <fwestpha@redhat.com>

Author: fw-strlen

net/netfilter/nf_tables_api.c

@@ -10156,6 +10156,9 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data,
 
 	if (!tb[NFTA_VERDICT_CODE])
 		return -EINVAL;
+
+	/* zero padding hole for memcmp */
+	memset(data, 0, sizeof(*data));
 	data->verdict.code = ntohl(nla_get_be32(tb[NFTA_VERDICT_CODE]));
 
 	switch (data->verdict.code) {