[PATCH nf-next] netfilter: nat: use test_and_clear_bit when deleting ct from bysource list

[PATCH nf-next] netfilter: nat: use test_and_clear_bit when deleting ct from bysource list

[Florian Westphal]

We can use a single statement for this.
While at it, fixup the comment -- we don't have pernet table/ops
anymore, the function is only called from module exit path.

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 This isn't a bug fix, nf_nat_proto_clean() is only called
 from module exit path so its not invoked concurrently.

 Nevertheless, I think its better to use single check/clear for this.
 If you disagree, just let me know and I can send a patch that only
 contains the comment change.

 net/netfilter/nf_nat_core.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index af8345fc4fbd..6c38421e31f9 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -542,17 +542,14 @@ static int nf_nat_proto_clean(struct nf_conn *ct, void *data)
 	if (nf_nat_proto_remove(ct, data))
 		return 1;
 
-	if ((ct->status & IPS_SRC_NAT_DONE) == 0)
-		return 0;
-
-	/* This netns is being destroyed, and conntrack has nat null binding.
+	/* This module is being removed and conntrack has nat null binding.
 	 * Remove it from bysource hash, as the table will be freed soon.
 	 *
 	 * Else, when the conntrack is destoyed, nf_nat_cleanup_conntrack()
 	 * will delete entry from already-freed table.
 	 */
-	clear_bit(IPS_SRC_NAT_DONE_BIT, &ct->status);
-	__nf_nat_cleanup_conntrack(ct);
+	if (test_and_clear_bit(IPS_SRC_NAT_DONE_BIT, &ct->status))
+		__nf_nat_cleanup_conntrack(ct);
 
 	/* don't delete conntrack.  Although that would make things a lot
 	 * simpler, we'd end up flushing all conntracks on nat rmmod.
-- 
2.13.6

Re: [PATCH nf-next] netfilter: nat: use test_and_clear_bit when deleting ct from bysource list

[Pablo Neira Ayuso]

On Thu, Oct 05, 2017 at 04:46:45PM +0200, Florian Westphal wrote:
> We can use a single statement for this.
> While at it, fixup the comment -- we don't have pernet table/ops
> anymore, the function is only called from module exit path.

Applied to nf-next, thanks.