From mboxrd@z Thu Jan 1 00:00:00 1970 From: Pablo Neira Ayuso Subject: [PATCH nf] netfilter: nf_tables: release objects on netns destruction Date: Sun, 29 Nov 2015 00:00:29 +0100 Message-ID: <1448751629-2965-1-git-send-email-pablo@netfilter.org> Cc: kaber@trash.net, arturo.borrero.glez@gmail.com To: netfilter-devel@vger.kernel.org Return-path: Received: from mail.us.es ([193.147.175.20]:39828 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751723AbbK1XAq (ORCPT ); Sat, 28 Nov 2015 18:00:46 -0500 Received: from antivirus1-rhel7.int (unknown [192.168.2.11]) by mail.us.es (Postfix) with ESMTP id 235B7B6B9E for ; Sun, 29 Nov 2015 00:00:44 +0100 (CET) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 186E5DA803 for ; Sun, 29 Nov 2015 00:00:44 +0100 (CET) Received: from antivirus1-rhel7.int (localhost [127.0.0.1]) by antivirus1-rhel7.int (Postfix) with ESMTP id 2769BDA732 for ; Sun, 29 Nov 2015 00:00:42 +0100 (CET) Sender: netfilter-devel-owner@vger.kernel.org List-ID: We have to release the existing objects on netns removal otherwise we leak them. Reported-by: Patrick McHardy Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_tables_api.c | 41 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 93cc473..428b90a 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -4584,7 +4584,7 @@ int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data, } EXPORT_SYMBOL_GPL(nft_data_dump); -static int nf_tables_init_net(struct net *net) +static int __net_init nf_tables_init_net(struct net *net) { INIT_LIST_HEAD(&net->nft.af_info); INIT_LIST_HEAD(&net->nft.commit_list); @@ -4592,8 +4592,47 @@ static int nf_tables_init_net(struct net *net) return 0; } +static void __net_exit nf_tables_exit_net(struct net *net) +{ + struct nft_table *table, *nt; + struct nft_chain *chain, *nc; + struct nft_rule *rule, *nr; + struct nft_set *set, *ns; + struct nft_af_info *afi; + struct nft_ctx ctx; + + nfnl_lock(NFNL_SUBSYS_NFTABLES); + list_for_each_entry(afi, &net->nft.af_info, list) { + ctx.afi = afi; + list_for_each_entry_safe(table, nt, &afi->tables, list) { + ctx.table = table; + list_for_each_entry(chain, &table->chains, list) { + ctx.chain = chain; + list_for_each_entry_safe(rule, nr, &chain->rules, list) { + list_del(&rule->list); + nf_tables_rule_destroy(&ctx, rule); + } + } + list_for_each_entry_safe(chain, nc, &table->chains, list) { + list_del(&chain->list); + nf_tables_unregister_hooks(table, chain, + afi->nops); + nf_tables_chain_destroy(chain); + } + list_for_each_entry_safe(set, ns, &table->sets, list) { + list_del(&set->list); + nft_set_destroy(set); + } + list_del(&table->list); + nf_tables_table_destroy(&ctx); + } + } + nfnl_unlock(NFNL_SUBSYS_NFTABLES); +} + static struct pernet_operations nf_tables_net_ops = { .init = nf_tables_init_net, + .exit = nf_tables_exit_net, }; static int __init nf_tables_module_init(void) -- 2.1.4