Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3b9960e2 authored by Florian Westphal's avatar Florian Westphal Committed by Greg Kroah-Hartman
Browse files

netfilter: nf_tables: don't write table validation state without mutex 



[ Upstream commit 9a32e9850686599ed194ccdceb6cd3dd56b2d9b9 ]

The ->cleanup callback needs to be removed, this doesn't work anymore as
the transaction mutex is already released in the ->abort function.

Just do it after a successful validation pass, this either happens
from commit or abort phases where transaction mutex is held.

Fixes: f102d66b ("netfilter: nf_tables: use dedicated mutex to guard transactions")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 64d2c1cf

include/linux/netfilter/nfnetlink.h

+0 −1
Original line number Diff line number Diff line
@@ -39,7 +39,6 @@ struct nfnetlink_subsystem { 
	int (*commit)(struct net *net, struct sk_buff *skb);

	int (*abort)(struct net *net, struct sk_buff *skb,

		     enum nfnl_abort_action action);

	void (*cleanup)(struct net *net);

	bool (*valid_genid)(struct net *net, u32 genid);

};

net/netfilter/nf_tables_api.c

+2 −6
Original line number Diff line number Diff line
@@ -6491,6 +6491,8 @@ static int nf_tables_validate(struct net *net) 
			if (nft_table_validate(net, table) < 0)

				return -EAGAIN;

		}



		nft_validate_state_update(net, NFT_VALIDATE_SKIP);

		break;

	}
@@ -7172,11 +7174,6 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 
	return 0;

}



static void nf_tables_cleanup(struct net *net)

{

	nft_validate_state_update(net, NFT_VALIDATE_SKIP);

}



static int nf_tables_abort(struct net *net, struct sk_buff *skb,

			   enum nfnl_abort_action action)

{
@@ -7208,7 +7205,6 @@ static const struct nfnetlink_subsystem nf_tables_subsys = { 
	.cb		= nf_tables_cb,

	.commit		= nf_tables_commit,

	.abort		= nf_tables_abort,

	.cleanup	= nf_tables_cleanup,

	.valid_genid	= nf_tables_valid_genid,

	.owner		= THIS_MODULE,

};

net/netfilter/nfnetlink.c

+0 −2
Original line number Diff line number Diff line
@@ -512,8 +512,6 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh, 
			goto replay_abort;

		}

	}

	if (ss->cleanup)

		ss->cleanup(net);



	nfnl_err_deliver(&err_list, oskb);

	kfree_skb(skb);