Re: [PATCH nf] netfilter: set on this module via struct netlink_dump_control

[Pablo Neira Ayuso <pablo@netfilter.org>]

For clarity, I plan to rename this patch subject to before applying.

netfilter: hold reference on module during netlink dump

On Wed, Sep 09, 2026 at 12:16:10AM +0200, Pablo Neira Ayuso wrote:
> Modules can be removed in the middle of a netlink dump. Set .module to
> THIS_MODULE in struct netlink_dump_control to hold a reference on the
> module while netlink dump is in progress.
> 
> See commit 6dc878a8ca39 ("netlink: add reference of module in
> netlink_dump_start") which describes this problem.
> 
> Fixes: a7b4f989a629 ("netfilter: ipset: IP set core support")
> Fixes: c1d10adb4a52 ("[NETFILTER]: Add ctnetlink port for nf_conntrack")
> Fixes: 50978462300f ("netfilter: add cttimeout infrastructure for fine timeout tuning")
> Fixes: 9413902796f5 ("netfilter: add extended accounting infrastructure over nfnetlink")
> Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure")
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
>  net/netfilter/ipset/ip_set_core.c    | 1 +
>  net/netfilter/nf_conntrack_netlink.c | 7 +++++++
>  net/netfilter/nfnetlink_acct.c       | 1 +
>  net/netfilter/nfnetlink_cthelper.c   | 1 +
>  net/netfilter/nfnetlink_cttimeout.c  | 1 +
>  5 files changed, 11 insertions(+)
> 
> diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
> index 0a86a170ba90..624c5f14acf6 100644
> --- a/net/netfilter/ipset/ip_set_core.c
> +++ b/net/netfilter/ipset/ip_set_core.c
> @@ -1733,6 +1733,7 @@ static int ip_set_dump(struct sk_buff *skb, const struct nfnl_info *info,
>  			.start = ip_set_dump_start,
>  			.dump = ip_set_dump_do,
>  			.done = ip_set_dump_done,
> +			.module = THIS_MODULE,
>  		};
>  		return netlink_dump_start(info->sk, skb, info->nlh, &c);
>  	}
> diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
> index 579ada063b1b..2340885b2076 100644
> --- a/net/netfilter/nf_conntrack_netlink.c
> +++ b/net/netfilter/nf_conntrack_netlink.c
> @@ -1682,6 +1682,7 @@ static int ctnetlink_get_conntrack(struct sk_buff *skb,
>  			.start = ctnetlink_start,
>  			.dump = ctnetlink_dump_table,
>  			.done = ctnetlink_done,
> +			.module = THIS_MODULE,
>  			.data = (void *)cda,
>  		};
>  
> @@ -1826,6 +1827,7 @@ static int ctnetlink_get_ct_dying(struct sk_buff *skb,
>  	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
>  		struct netlink_dump_control c = {
>  			.dump = ctnetlink_dump_dying,
> +			.module = THIS_MODULE,
>  		};
>  		return netlink_dump_start(info->sk, skb, info->nlh, &c);
>  	}
> @@ -1840,6 +1842,7 @@ static int ctnetlink_get_ct_unconfirmed(struct sk_buff *skb,
>  	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
>  		struct netlink_dump_control c = {
>  			.dump = ctnetlink_dump_unconfirmed,
> +			.module = THIS_MODULE,
>  		};
>  		return netlink_dump_start(info->sk, skb, info->nlh, &c);
>  	}
> @@ -2555,6 +2558,7 @@ static int ctnetlink_stat_ct_cpu(struct sk_buff *skb,
>  	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
>  		struct netlink_dump_control c = {
>  			.dump = ctnetlink_ct_stat_cpu_dump,
> +			.module = THIS_MODULE,
>  		};
>  		return netlink_dump_start(info->sk, skb, info->nlh, &c);
>  	}
> @@ -3278,6 +3282,7 @@ static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl,
>  		.dump = ctnetlink_exp_ct_dump_table,
>  		.start = ctnetlink_dump_exp_ct_start,
>  		.done = ctnetlink_dump_exp_ct_done,
> +		.module = THIS_MODULE,
>  	};
>  
>  	err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER,
> @@ -3327,6 +3332,7 @@ static int ctnetlink_get_expect(struct sk_buff *skb,
>  		else {
>  			struct netlink_dump_control c = {
>  				.dump = ctnetlink_exp_dump_table,
> +				.module = THIS_MODULE,
>  			};
>  			return netlink_dump_start(info->sk, skb, info->nlh, &c);
>  		}
> @@ -3748,6 +3754,7 @@ static int ctnetlink_stat_exp_cpu(struct sk_buff *skb,
>  	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
>  		struct netlink_dump_control c = {
>  			.dump = ctnetlink_exp_stat_cpu_dump,
> +			.module = THIS_MODULE,
>  		};
>  		return netlink_dump_start(info->sk, skb, info->nlh, &c);
>  	}
> diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
> index 8ff1e0ad5cb0..39a62bb9a6e6 100644
> --- a/net/netfilter/nfnetlink_acct.c
> +++ b/net/netfilter/nfnetlink_acct.c
> @@ -284,6 +284,7 @@ static int nfnl_acct_get(struct sk_buff *skb, const struct nfnl_info *info,
>  			.dump = nfnl_acct_dump,
>  			.start = nfnl_acct_start,
>  			.done = nfnl_acct_done,
> +			.module = THIS_MODULE,
>  			.data = (void *)tb[NFACCT_FILTER],
>  		};
>  
> diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
> index 5b6a09f46903..1331aba007ba 100644
> --- a/net/netfilter/nfnetlink_cthelper.c
> +++ b/net/netfilter/nfnetlink_cthelper.c
> @@ -644,6 +644,7 @@ static int nfnl_cthelper_get(struct sk_buff *skb, const struct nfnl_info *info,
>  	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
>  		struct netlink_dump_control c = {
>  			.dump = nfnl_cthelper_dump_table,
> +			.module = THIS_MODULE,
>  		};
>  		return netlink_dump_start(info->sk, skb, info->nlh, &c);
>  	}
> diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
> index 132c02ac7c4e..29de875d1713 100644
> --- a/net/netfilter/nfnetlink_cttimeout.c
> +++ b/net/netfilter/nfnetlink_cttimeout.c
> @@ -277,6 +277,7 @@ static int cttimeout_get_timeout(struct sk_buff *skb,
>  	if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
>  		struct netlink_dump_control c = {
>  			.dump = ctnl_timeout_dump,
> +			.module = THIS_MODULE,
>  		};
>  		return netlink_dump_start(info->sk, skb, info->nlh, &c);
>  	}
> -- 
> 2.47.3
> 
>