Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit df05ef87 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: release objects on netns destruction 



We have to release the existing objects on netns removal otherwise we
leak them. Chains are unregistered in first place to make sure no
packets are walking on our rules and sets anymore.

The object release happens by when we unregister the family via
nft_release_afinfo() which is called from nft_unregister_afinfo() from
the corresponding __net_exit path in every family.

Reported-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 26a4d063

include/net/netfilter/nf_tables.h

+1 −1
Original line number Diff line number Diff line
@@ -880,7 +880,7 @@ struct nft_af_info { 
};



int nft_register_afinfo(struct net *, struct nft_af_info *);

void nft_unregister_afinfo(struct nft_af_info *);

void nft_unregister_afinfo(struct net *, struct nft_af_info *);



int nft_register_chain_type(const struct nf_chain_type *);

void nft_unregister_chain_type(const struct nf_chain_type *);

net/bridge/netfilter/nf_tables_bridge.c

+1 −1
Original line number Diff line number Diff line
@@ -141,7 +141,7 @@ static int nf_tables_bridge_init_net(struct net *net) 


static void nf_tables_bridge_exit_net(struct net *net)

{

	nft_unregister_afinfo(net->nft.bridge);

	nft_unregister_afinfo(net, net->nft.bridge);

	kfree(net->nft.bridge);

}

net/ipv4/netfilter/nf_tables_arp.c

+1 −1
Original line number Diff line number Diff line
@@ -57,7 +57,7 @@ static int nf_tables_arp_init_net(struct net *net) 


static void nf_tables_arp_exit_net(struct net *net)

{

	nft_unregister_afinfo(net->nft.arp);

	nft_unregister_afinfo(net, net->nft.arp);

	kfree(net->nft.arp);

}

net/ipv4/netfilter/nf_tables_ipv4.c

+1 −1
Original line number Diff line number Diff line
@@ -78,7 +78,7 @@ static int nf_tables_ipv4_init_net(struct net *net) 


static void nf_tables_ipv4_exit_net(struct net *net)

{

	nft_unregister_afinfo(net->nft.ipv4);

	nft_unregister_afinfo(net, net->nft.ipv4);

	kfree(net->nft.ipv4);

}

net/ipv6/netfilter/nf_tables_ipv6.c

+1 −1
Original line number Diff line number Diff line
@@ -77,7 +77,7 @@ static int nf_tables_ipv6_init_net(struct net *net) 


static void nf_tables_ipv6_exit_net(struct net *net)

{

	nft_unregister_afinfo(net->nft.ipv6);

	nft_unregister_afinfo(net, net->nft.ipv6);

	kfree(net->nft.ipv6);

}