* [PATCH nf v2] netfilter: ipset: pernet ops must be unregistered last
@ 2017-09-26 9:57 Florian Westphal
2017-09-26 17:48 ` Jozsef Kadlecsik
0 siblings, 1 reply; 3+ messages in thread
From: Florian Westphal @ 2017-09-26 9:57 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
Removing the ipset module leaves a small window where one cpu performs
module removal while another runs a command like 'ipset flush'.
ipset uses net_generic(), unregistering the pernet ops frees this
storage area.
Fix it by first removing the user-visible api handlers and the pernet
ops last.
Fixes: 1785e8f473082 ("netfiler: ipset: Add net namespace for ipset")
Reported-by: Li Shuang <shuali@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
Change since v2:
- unregister setsockopt first (i.e., use reverse order)
net/netfilter/ipset/ip_set_core.c | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index e495b5e484b1..a7f049ff3049 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -2072,25 +2072,28 @@ static struct pernet_operations ip_set_net_ops = {
static int __init
ip_set_init(void)
{
- int ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
+ int ret = register_pernet_subsys(&ip_set_net_ops);
+ if (ret) {
+ pr_err("ip_set: cannot register pernet_subsys.\n");
+ return ret;
+ }
+
+ ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
if (ret != 0) {
pr_err("ip_set: cannot register with nfnetlink.\n");
+ unregister_pernet_subsys(&ip_set_net_ops);
return ret;
}
+
ret = nf_register_sockopt(&so_set);
if (ret != 0) {
pr_err("SO_SET registry failed: %d\n", ret);
nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
+ unregister_pernet_subsys(&ip_set_net_ops);
return ret;
}
- ret = register_pernet_subsys(&ip_set_net_ops);
- if (ret) {
- pr_err("ip_set: cannot register pernet_subsys.\n");
- nf_unregister_sockopt(&so_set);
- nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
- return ret;
- }
+
pr_info("ip_set: protocol %u\n", IPSET_PROTOCOL);
return 0;
}
@@ -2098,9 +2101,10 @@ ip_set_init(void)
static void __exit
ip_set_fini(void)
{
- unregister_pernet_subsys(&ip_set_net_ops);
nf_unregister_sockopt(&so_set);
nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
+
+ unregister_pernet_subsys(&ip_set_net_ops);
pr_debug("these are the famous last words\n");
}
--
2.13.5
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH nf v2] netfilter: ipset: pernet ops must be unregistered last
2017-09-26 9:57 [PATCH nf v2] netfilter: ipset: pernet ops must be unregistered last Florian Westphal
@ 2017-09-26 17:48 ` Jozsef Kadlecsik
2017-09-26 17:58 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Jozsef Kadlecsik @ 2017-09-26 17:48 UTC (permalink / raw)
To: Florian Westphal, Pablo Neira Ayuso; +Cc: netfilter-devel
On Tue, 26 Sep 2017, Florian Westphal wrote:
> Removing the ipset module leaves a small window where one cpu performs
> module removal while another runs a command like 'ipset flush'.
>
> ipset uses net_generic(), unregistering the pernet ops frees this
> storage area.
>
> Fix it by first removing the user-visible api handlers and the pernet
> ops last.
>
> Fixes: 1785e8f473082 ("netfiler: ipset: Add net namespace for ipset")
> Reported-by: Li Shuang <shuali@redhat.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Pablo, could you apply the patch in the nf tree?
Best regards,
Jozsef
> ---
> Change since v2:
> - unregister setsockopt first (i.e., use reverse order)
>
> net/netfilter/ipset/ip_set_core.c | 22 +++++++++++++---------
> 1 file changed, 13 insertions(+), 9 deletions(-)
>
> diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
> index e495b5e484b1..a7f049ff3049 100644
> --- a/net/netfilter/ipset/ip_set_core.c
> +++ b/net/netfilter/ipset/ip_set_core.c
> @@ -2072,25 +2072,28 @@ static struct pernet_operations ip_set_net_ops = {
> static int __init
> ip_set_init(void)
> {
> - int ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
> + int ret = register_pernet_subsys(&ip_set_net_ops);
>
> + if (ret) {
> + pr_err("ip_set: cannot register pernet_subsys.\n");
> + return ret;
> + }
> +
> + ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
> if (ret != 0) {
> pr_err("ip_set: cannot register with nfnetlink.\n");
> + unregister_pernet_subsys(&ip_set_net_ops);
> return ret;
> }
> +
> ret = nf_register_sockopt(&so_set);
> if (ret != 0) {
> pr_err("SO_SET registry failed: %d\n", ret);
> nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
> + unregister_pernet_subsys(&ip_set_net_ops);
> return ret;
> }
> - ret = register_pernet_subsys(&ip_set_net_ops);
> - if (ret) {
> - pr_err("ip_set: cannot register pernet_subsys.\n");
> - nf_unregister_sockopt(&so_set);
> - nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
> - return ret;
> - }
> +
> pr_info("ip_set: protocol %u\n", IPSET_PROTOCOL);
> return 0;
> }
> @@ -2098,9 +2101,10 @@ ip_set_init(void)
> static void __exit
> ip_set_fini(void)
> {
> - unregister_pernet_subsys(&ip_set_net_ops);
> nf_unregister_sockopt(&so_set);
> nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
> +
> + unregister_pernet_subsys(&ip_set_net_ops);
> pr_debug("these are the famous last words\n");
> }
>
> --
> 2.13.5
>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
-
E-mail : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
H-1525 Budapest 114, POB. 49, Hungary
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH nf v2] netfilter: ipset: pernet ops must be unregistered last
2017-09-26 17:48 ` Jozsef Kadlecsik
@ 2017-09-26 17:58 ` Pablo Neira Ayuso
0 siblings, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2017-09-26 17:58 UTC (permalink / raw)
To: Jozsef Kadlecsik; +Cc: Florian Westphal, netfilter-devel
On Tue, Sep 26, 2017 at 07:48:45PM +0200, Jozsef Kadlecsik wrote:
> On Tue, 26 Sep 2017, Florian Westphal wrote:
>
> > Removing the ipset module leaves a small window where one cpu performs
> > module removal while another runs a command like 'ipset flush'.
> >
> > ipset uses net_generic(), unregistering the pernet ops frees this
> > storage area.
> >
> > Fix it by first removing the user-visible api handlers and the pernet
> > ops last.
> >
> > Fixes: 1785e8f473082 ("netfiler: ipset: Add net namespace for ipset")
> > Reported-by: Li Shuang <shuali@redhat.com>
> > Signed-off-by: Florian Westphal <fw@strlen.de>
>
> Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
>
> Pablo, could you apply the patch in the nf tree?
Applied, thanks Jozsef.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-09-26 17:58 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-09-26 9:57 [PATCH nf v2] netfilter: ipset: pernet ops must be unregistered last Florian Westphal
2017-09-26 17:48 ` Jozsef Kadlecsik
2017-09-26 17:58 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).