* [PATCH nf] netfilter: nftables: fix possible double hook unregistration with table owner
@ 2021-03-04 2:48 Pablo Neira Ayuso
0 siblings, 0 replies; only message in thread
From: Pablo Neira Ayuso @ 2021-03-04 2:48 UTC (permalink / raw)
To: netfilter-devel
Skip hook unregistration of owner tables from the netns exit path,
nft_rcv_nl_event() unregisters the table hooks before tearing down
the table content.
Fixes: 6001a930ce03 ("netfilter: nftables: introduce table ownership")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index b07703e19108..495f320b1c93 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -9024,12 +9024,17 @@ static void __nft_release_hook(struct net *net, struct nft_table *table)
nf_tables_unregister_hook(net, table, chain);
}
-static void __nft_release_hooks(struct net *net)
+static void __nft_release_hooks(struct net *net, u32 nlpid)
{
struct nft_table *table;
- list_for_each_entry(table, &net->nft.tables, list)
+ list_for_each_entry(table, &net->nft.tables, list) {
+ if (nft_table_has_owner(table) &&
+ nlpid != table->nlpid)
+ continue;
+
__nft_release_hook(net, table);
+ }
}
static void __nft_release_table(struct net *net, struct nft_table *table)
@@ -9143,7 +9148,7 @@ static int __net_init nf_tables_init_net(struct net *net)
static void __net_exit nf_tables_pre_exit_net(struct net *net)
{
- __nft_release_hooks(net);
+ __nft_release_hooks(net, 0);
}
static void __net_exit nf_tables_exit_net(struct net *net)
--
2.20.1
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2021-03-04 2:50 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-03-04 2:48 [PATCH nf] netfilter: nftables: fix possible double hook unregistration with table owner Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).