Re: [PATCH nf] netfilter: nft_compat: run checkentry() from .validate

[Florian Westphal <fw@strlen.de>]

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> On Mon, Apr 20, 2026 at 07:55:22PM +0200, Florian Westphal wrote:
> > Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > Several matches and one target check that the hook is correct from
> > > checkentry(), however, the basechain is only available from
> > > nft_table_validate().
> > > 
> > > This patch calls checkentry() for matches and targets from the
> > > nft_compat expression .validate path for the following matches/target:
> > 
> > I worry that this is fragile.  Not all ->checkentry callbacks are pure.
> > Some create /proc entries or bump reference counts.
> 
> xt_set does bump the reference count. This calls xt.destroy to restore it.
> I am only calling them for the list of expression you mentioned.

I worry this will lead to trouble later, e.g. info->priv = kmalloc( ...)
-> memory leak.

But OK, at least there is a test case in iptables.git for this.