[PATCH nf] netfilter: nft_set_rbtree: reject interval-end get for open intervals

[Melbin K Mathew]

nft_rbtree_get() uses the interval endpoint selected by
nft_array_get_cmp(). For NFT_SET_ELEM_INTERVAL_END requests, the function
uses interval->to to recover struct nft_rbtree_elem.

Open-ended intervals can have a NULL end endpoint. In that case,
nft_array_get_cmp() treats the missing endpoint as b = -1, which can
still match an interval-end query. Avoid deriving an element pointer
from a NULL endpoint and report the element as not found instead.

Return -ENOENT for interval-end requests against open-ended intervals.

Fixes: 2aa34191f06f ("netfilter: nft_set_rbtree: use binary search array in get command")
Signed-off-by: Melbin K Mathew <mlbnkm1@xxxxxxxxx>
---
Notes:
  A reduced userspace model confirms the comparator returns match for a
  NULL-ended interval when NFT_SET_ELEM_INTERVAL_END is set, and that
  container_of(NULL, ext) produces a garbage pointer (UBSAN fires).

  I have not reproduced an end-to-end crash through normal nft CLI usage.
  An instrumented WARN in this branch did not fire during interval-set
  tests with nft add/get/list. The patch is a defensive fix for the NULL
  endpoint case.

  Tested on 7.2-rc1 with KASAN and UBSAN enabled. Function tracing
  confirms nft_rbtree_get() is reached via nft get element. The added
  guard returns -ENOENT for a NULL interval endpoint in the instrumented
  test case.
---
 net/netfilter/nft_set_rbtree.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index 018bbb6df4..024a2cd3a6 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -184,10 +184,13 @@ nft_rbtree_get(const struct net *net, const struct nft_set *set,
 	if (!interval || nft_set_elem_expired(interval->from))
 		return ERR_PTR(-ENOENT);
 
-	if (flags & NFT_SET_ELEM_INTERVAL_END)
+	if (flags & NFT_SET_ELEM_INTERVAL_END) {
+		if (!interval->to)
+			return ERR_PTR(-ENOENT);
 		rbe = container_of(interval->to, struct nft_rbtree_elem, ext);
-	else
+	} else {
 		rbe = container_of(interval->from, struct nft_rbtree_elem, ext);
+	}
 
 	return &rbe->priv;
 }
-- 
2.39.5