Commit d376bef9 authored Jul 04, 2018 by Florian Westphal Committed by Pablo Neira Ayuso Jul 05, 2018

netfilter: x_tables: set module owner for icmp(6) matches



nft_compat relies on xt_request_find_match to increment
refcount of the module that provides the match/target.

The (builtin) icmp matches did't set the module owner so it
was possible to rmmod ip(6)tables while icmp extensions were still in use.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

parent d461e3da

net/ipv4/netfilter/ip_tables.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -1898,6 +1898,7 @@ static struct xt_match ipt_builtin_mt[] __read_mostly = {
		.checkentry = icmp_checkentry,
		.proto = IPPROTO_ICMP,
		.family = NFPROTO_IPV4,
		.me = THIS_MODULE,
		},
		};

net/ipv6/netfilter/ip6_tables.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -1909,6 +1909,7 @@ static struct xt_match ip6t_builtin_mt[] __read_mostly = {
		.checkentry = icmp6_checkentry,
		.proto = IPPROTO_ICMPV6,
		.family = NFPROTO_IPV6,
		.me = THIS_MODULE,
		},
		};