mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-05 16:37:50 +00:00
netfilter: nf_tables: delete flowtable hooks via transaction list
[ Upstream commitb6d9014a33
] Remove inactive bool field in nft_hook object that was introduced inabadb2f865
("netfilter: nf_tables: delete devices from flowtable"). Move stale flowtable hooks to transaction list instead. Deleting twice the same device does not result in ENOENT. Fixes:abadb2f865
("netfilter: nf_tables: delete devices from flowtable") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
13c5b35c50
commit
99180dec5a
2 changed files with 6 additions and 26 deletions
|
@ -1090,7 +1090,6 @@ struct nft_stats {
|
||||||
|
|
||||||
struct nft_hook {
|
struct nft_hook {
|
||||||
struct list_head list;
|
struct list_head list;
|
||||||
bool inactive;
|
|
||||||
struct nf_hook_ops ops;
|
struct nf_hook_ops ops;
|
||||||
struct rcu_head rcu;
|
struct rcu_head rcu;
|
||||||
};
|
};
|
||||||
|
|
|
@ -1914,7 +1914,6 @@ static struct nft_hook *nft_netdev_hook_alloc(struct net *net,
|
||||||
goto err_hook_dev;
|
goto err_hook_dev;
|
||||||
}
|
}
|
||||||
hook->ops.dev = dev;
|
hook->ops.dev = dev;
|
||||||
hook->inactive = false;
|
|
||||||
|
|
||||||
return hook;
|
return hook;
|
||||||
|
|
||||||
|
@ -7612,6 +7611,7 @@ static int nft_delflowtable_hook(struct nft_ctx *ctx,
|
||||||
{
|
{
|
||||||
const struct nlattr * const *nla = ctx->nla;
|
const struct nlattr * const *nla = ctx->nla;
|
||||||
struct nft_flowtable_hook flowtable_hook;
|
struct nft_flowtable_hook flowtable_hook;
|
||||||
|
LIST_HEAD(flowtable_del_list);
|
||||||
struct nft_hook *this, *hook;
|
struct nft_hook *this, *hook;
|
||||||
struct nft_trans *trans;
|
struct nft_trans *trans;
|
||||||
int err;
|
int err;
|
||||||
|
@ -7627,7 +7627,7 @@ static int nft_delflowtable_hook(struct nft_ctx *ctx,
|
||||||
err = -ENOENT;
|
err = -ENOENT;
|
||||||
goto err_flowtable_del_hook;
|
goto err_flowtable_del_hook;
|
||||||
}
|
}
|
||||||
hook->inactive = true;
|
list_move(&hook->list, &flowtable_del_list);
|
||||||
}
|
}
|
||||||
|
|
||||||
trans = nft_trans_alloc(ctx, NFT_MSG_DELFLOWTABLE,
|
trans = nft_trans_alloc(ctx, NFT_MSG_DELFLOWTABLE,
|
||||||
|
@ -7640,6 +7640,7 @@ static int nft_delflowtable_hook(struct nft_ctx *ctx,
|
||||||
nft_trans_flowtable(trans) = flowtable;
|
nft_trans_flowtable(trans) = flowtable;
|
||||||
nft_trans_flowtable_update(trans) = true;
|
nft_trans_flowtable_update(trans) = true;
|
||||||
INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans));
|
INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans));
|
||||||
|
list_splice(&flowtable_del_list, &nft_trans_flowtable_hooks(trans));
|
||||||
nft_flowtable_hook_release(&flowtable_hook);
|
nft_flowtable_hook_release(&flowtable_hook);
|
||||||
|
|
||||||
nft_trans_commit_list_add_tail(ctx->net, trans);
|
nft_trans_commit_list_add_tail(ctx->net, trans);
|
||||||
|
@ -7647,13 +7648,7 @@ static int nft_delflowtable_hook(struct nft_ctx *ctx,
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
err_flowtable_del_hook:
|
err_flowtable_del_hook:
|
||||||
list_for_each_entry(this, &flowtable_hook.list, list) {
|
list_splice(&flowtable_del_list, &flowtable->hook_list);
|
||||||
hook = nft_hook_list_find(&flowtable->hook_list, this);
|
|
||||||
if (!hook)
|
|
||||||
break;
|
|
||||||
|
|
||||||
hook->inactive = false;
|
|
||||||
}
|
|
||||||
nft_flowtable_hook_release(&flowtable_hook);
|
nft_flowtable_hook_release(&flowtable_hook);
|
||||||
|
|
||||||
return err;
|
return err;
|
||||||
|
@ -8559,17 +8554,6 @@ void nft_chain_del(struct nft_chain *chain)
|
||||||
list_del_rcu(&chain->list);
|
list_del_rcu(&chain->list);
|
||||||
}
|
}
|
||||||
|
|
||||||
static void nft_flowtable_hooks_del(struct nft_flowtable *flowtable,
|
|
||||||
struct list_head *hook_list)
|
|
||||||
{
|
|
||||||
struct nft_hook *hook, *next;
|
|
||||||
|
|
||||||
list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
|
|
||||||
if (hook->inactive)
|
|
||||||
list_move(&hook->list, hook_list);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static void nf_tables_module_autoload_cleanup(struct net *net)
|
static void nf_tables_module_autoload_cleanup(struct net *net)
|
||||||
{
|
{
|
||||||
struct nftables_pernet *nft_net = nft_pernet(net);
|
struct nftables_pernet *nft_net = nft_pernet(net);
|
||||||
|
@ -8914,8 +8898,6 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
|
||||||
break;
|
break;
|
||||||
case NFT_MSG_DELFLOWTABLE:
|
case NFT_MSG_DELFLOWTABLE:
|
||||||
if (nft_trans_flowtable_update(trans)) {
|
if (nft_trans_flowtable_update(trans)) {
|
||||||
nft_flowtable_hooks_del(nft_trans_flowtable(trans),
|
|
||||||
&nft_trans_flowtable_hooks(trans));
|
|
||||||
nf_tables_flowtable_notify(&trans->ctx,
|
nf_tables_flowtable_notify(&trans->ctx,
|
||||||
nft_trans_flowtable(trans),
|
nft_trans_flowtable(trans),
|
||||||
&nft_trans_flowtable_hooks(trans),
|
&nft_trans_flowtable_hooks(trans),
|
||||||
|
@ -8996,7 +8978,6 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
|
||||||
struct nftables_pernet *nft_net = nft_pernet(net);
|
struct nftables_pernet *nft_net = nft_pernet(net);
|
||||||
struct nft_trans *trans, *next;
|
struct nft_trans *trans, *next;
|
||||||
struct nft_trans_elem *te;
|
struct nft_trans_elem *te;
|
||||||
struct nft_hook *hook;
|
|
||||||
|
|
||||||
if (action == NFNL_ABORT_VALIDATE &&
|
if (action == NFNL_ABORT_VALIDATE &&
|
||||||
nf_tables_validate(net) < 0)
|
nf_tables_validate(net) < 0)
|
||||||
|
@ -9127,8 +9108,8 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
|
||||||
break;
|
break;
|
||||||
case NFT_MSG_DELFLOWTABLE:
|
case NFT_MSG_DELFLOWTABLE:
|
||||||
if (nft_trans_flowtable_update(trans)) {
|
if (nft_trans_flowtable_update(trans)) {
|
||||||
list_for_each_entry(hook, &nft_trans_flowtable(trans)->hook_list, list)
|
list_splice(&nft_trans_flowtable_hooks(trans),
|
||||||
hook->inactive = false;
|
&nft_trans_flowtable(trans)->hook_list);
|
||||||
} else {
|
} else {
|
||||||
trans->ctx.table->use++;
|
trans->ctx.table->use++;
|
||||||
nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
|
nft_clear(trans->ctx.net, nft_trans_flowtable(trans));
|
||||||
|
|
Loading…
Reference in a new issue