Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4b6346dc authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Greg Kroah-Hartman
Browse files

netfilter: nf_tables: GC transaction race with abort path 



commit 720344340fb9be2765bbaab7b292ece0a4570eae upstream.

Abort path is missing a synchronization point with GC transactions. Add
GC sequence number hence any GC transaction losing race will be
discarded.

Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b76dcf46

net/netfilter/nf_tables_api.c

+6 −1
Original line number Diff line number Diff line
@@ -7597,7 +7597,12 @@ static int nf_tables_abort(struct net *net, struct sk_buff *skb, 
			   enum nfnl_abort_action action)

{

	struct nftables_pernet *nft_net = net_generic(net, nf_tables_net_id);

	int ret = __nf_tables_abort(net, action);

	unsigned int gc_seq;

	int ret;



	gc_seq = nft_gc_seq_begin(nft_net);

	ret = __nf_tables_abort(net, action);

	nft_gc_seq_end(nft_net, gc_seq);



	mutex_unlock(&nft_net->commit_mutex);