netfilter: nf_tables: discard table flag update with pending basechain deletion
commit1bc83a019b
upstream. Hook unregistration is deferred to the commit phase, same occurs with hook updates triggered by the table dormant flag. When both commands are combined, this results in deleting a basechain while leaving its hook still registered in the core. Fixes:179d9ba555
("netfilter: nf_tables: fix table flag updates") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
8b891153b2
commit
9627fd0c6e
|
@ -1209,10 +1209,11 @@ static bool nft_table_pending_update(const struct nft_ctx *ctx)
|
|||
return true;
|
||||
|
||||
list_for_each_entry(trans, &nft_net->commit_list, list) {
|
||||
if ((trans->msg_type == NFT_MSG_NEWCHAIN ||
|
||||
trans->msg_type == NFT_MSG_DELCHAIN) &&
|
||||
trans->ctx.table == ctx->table &&
|
||||
nft_trans_chain_update(trans))
|
||||
if (trans->ctx.table == ctx->table &&
|
||||
((trans->msg_type == NFT_MSG_NEWCHAIN &&
|
||||
nft_trans_chain_update(trans)) ||
|
||||
(trans->msg_type == NFT_MSG_DELCHAIN &&
|
||||
nft_is_base_chain(trans->ctx.chain))))
|
||||
return true;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue