[PATCH nf] netfilter: nftables: fix possible double hook unregistration with table owner

[Pablo Neira Ayuso <pablo@netfilter.org>]

Skip hook unregistration of owner tables from the netns exit path,
nft_rcv_nl_event() unregisters the table hooks before tearing down
the table content.

Fixes: 6001a930ce03 ("netfilter: nftables: introduce table ownership")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_tables_api.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index b07703e19108..495f320b1c93 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -9024,12 +9024,17 @@ static void __nft_release_hook(struct net *net, struct nft_table *table)
 		nf_tables_unregister_hook(net, table, chain);
 }
 
-static void __nft_release_hooks(struct net *net)
+static void __nft_release_hooks(struct net *net, u32 nlpid)
 {
 	struct nft_table *table;
 
-	list_for_each_entry(table, &net->nft.tables, list)
+	list_for_each_entry(table, &net->nft.tables, list) {
+		if (nft_table_has_owner(table) &&
+		    nlpid != table->nlpid)
+			continue;
+
 		__nft_release_hook(net, table);
+	}
 }
 
 static void __nft_release_table(struct net *net, struct nft_table *table)
@@ -9143,7 +9148,7 @@ static int __net_init nf_tables_init_net(struct net *net)
 
 static void __net_exit nf_tables_pre_exit_net(struct net *net)
 {
-	__nft_release_hooks(net);
+	__nft_release_hooks(net, 0);
 }
 
 static void __net_exit nf_tables_exit_net(struct net *net)
-- 
2.20.1