linux-stable/include/net/netfilter
Vasily Averin a23f89a999 netfilter: conntrack: nf_ct_gre_keymap_flush() removal
nf_ct_gre_keymap_flush() is useless.
It is called from nf_conntrack_cleanup_net_list() only and tries to remove
nf_ct_gre_keymap entries from pernet gre keymap list. Though:
a) at this point the list should already be empty, all its entries were
deleted during the conntracks cleanup, because
nf_conntrack_cleanup_net_list() executes nf_ct_iterate_cleanup(kill_all)
before nf_conntrack_proto_pernet_fini():
 nf_conntrack_cleanup_net_list
  +- nf_ct_iterate_cleanup
  |   nf_ct_put
  |    nf_conntrack_put
  |     nf_conntrack_destroy
  |      destroy_conntrack
  |       destroy_gre_conntrack
  |        nf_ct_gre_keymap_destroy
  `- nf_conntrack_proto_pernet_fini
      nf_ct_gre_keymap_flush

b) Let's say we find that the keymap list is not empty. This means netns
still has a conntrack associated with gre, in which case we should not free
its memory, because this will lead to a double free and related crashes.
However I doubt it could have gone unnoticed for years, obviously
this does not happen in real life. So I think we can remove
both nf_ct_gre_keymap_flush() and nf_conntrack_proto_pernet_fini().

Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2021-07-02 02:07:01 +02:00
..
ipv4 netfilter: disable defrag once its no longer needed 2021-04-26 03:20:07 +02:00
ipv6 netfilter: disable defrag once its no longer needed 2021-04-26 03:20:07 +02:00
br_netfilter.h netfilter: remove CONFIG_NETFILTER checks from headers. 2019-09-13 12:47:36 +02:00
nf_conntrack.h netfilter: nftables: add nf_ct_pernet() helper function 2021-06-07 12:23:37 +02:00
nf_conntrack_acct.h netfilter: conntrack: add nf_ct_acct_add() 2020-03-30 02:05:39 +02:00
nf_conntrack_bridge.h netfilter: remove CONFIG_NETFILTER checks from headers. 2019-09-13 12:47:36 +02:00
nf_conntrack_core.h netfilter: conntrack: nf_ct_gre_keymap_flush() removal 2021-07-02 02:07:01 +02:00
nf_conntrack_count.h netfilter: add missing includes to a number of header-files. 2019-08-13 12:14:39 +02:00
nf_conntrack_ecache.h netfilter: conntrack: move ecache dwork to net_generic infra 2021-04-06 00:34:53 +02:00
nf_conntrack_expect.h netfilter: fix coding-style errors. 2019-09-13 11:39:38 +02:00
nf_conntrack_extend.h netfilter: Replace zero-length array with flexible-array member 2020-03-15 15:20:16 +01:00
nf_conntrack_helper.h treewide: Use sizeof_field() macro 2019-12-09 10:36:44 -08:00
nf_conntrack_l4proto.h netfilter: conntrack: pass hook state to log functions 2021-06-18 14:47:43 +02:00
nf_conntrack_labels.h netfilter: fix include guards. 2019-09-13 11:39:38 +02:00
nf_conntrack_seqadj.h
nf_conntrack_synproxy.h netfilter: conntrack: wrap two inline functions in config checks. 2019-09-13 12:47:10 +02:00
nf_conntrack_timeout.h netfilter: Replace zero-length array with flexible-array member 2020-03-15 15:20:16 +01:00
nf_conntrack_timestamp.h netfilter: conntrack: remove two unused functions from nf_conntrack_timestamp.h. 2019-09-13 12:48:09 +02:00
nf_conntrack_tuple.h netfilter: remove CONFIG_NETFILTER checks from headers. 2019-09-13 12:47:36 +02:00
nf_conntrack_zones.h netfilter: conntrack: remove CONFIG_NF_CONNTRACK checks from nf_conntrack_zones.h. 2019-09-13 12:47:41 +02:00
nf_dup_netdev.h netfilter: nft_{fwd,dup}_netdev: add offload support 2019-09-10 22:44:29 +02:00
nf_flow_table.h netfilter: flowtable: Set offload timeouts according to proto values 2021-06-07 12:23:38 +02:00
nf_log.h netfilter: nf_log_common: merge with nf_log_syslog 2021-03-31 22:34:10 +02:00
nf_nat.h netfilter: nat: move nf_xfrm_me_harder to where it is used 2021-04-26 03:20:07 +02:00
nf_nat_helper.h netfilter: add missing includes to a number of header-files. 2019-08-13 12:14:39 +02:00
nf_nat_masquerade.h netfilter: update include directives. 2019-09-13 12:33:06 +02:00
nf_nat_redirect.h netfilter: add missing includes to a number of header-files. 2019-08-13 12:14:39 +02:00
nf_queue.h netfilter: nf_queue: place bridge physports into queue_entry struct 2020-03-29 16:28:29 +02:00
nf_reject.h netfilter: add missing includes to a number of header-files. 2019-08-13 12:14:39 +02:00
nf_socket.h
nf_synproxy.h netfilter: remove CONFIG_NETFILTER checks from headers. 2019-09-13 12:47:36 +02:00
nf_tables.h Merge ra.kernel.org:/pub/scm/linux/kernel/git/netdev/net 2021-06-07 13:01:52 -07:00
nf_tables_core.h netfilter: nf_tables: add last expression 2021-06-17 03:23:00 +02:00
nf_tables_ipv4.h netfilter: nf_tables: remove xt_action_param from nft_pktinfo 2021-05-29 22:15:59 +02:00
nf_tables_ipv6.h netfilter: nf_tables: remove xt_action_param from nft_pktinfo 2021-05-29 22:15:59 +02:00
nf_tables_offload.h netfilter: nftables: counter hardware offload support 2021-04-18 22:04:49 +02:00
nf_tproxy.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 2018-07-20 22:28:28 -07:00
nft_fib.h netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
nft_meta.h netfilter: nftables: add nft_parse_register_store() and use it 2021-01-27 23:16:02 +01:00
nft_reject.h netfilter: add missing includes to a number of header-files. 2019-08-13 12:14:39 +02:00
xt_rateest.h