xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: nf_tables: don't write table validation state without mutex

Browse Source 
[ Upstream commit 9a32e9850686599ed194ccdceb6cd3dd56b2d9b9 ]

The ->cleanup callback needs to be removed, this doesn't work anymore as
the transaction mutex is already released in the ->abort function.

Just do it after a successful validation pass, this either happens
from commit or abort phases where transaction mutex is held.

Fixes: f102d66b33 ("netfilter: nf_tables: use dedicated mutex to guard transactions")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Florian Westphal
2023-04-13 17:13:19 +02:00
committed by Greg Kroah-Hartman
parent f4fc43fde1
commit cb71b24a89
3 changed files with 2 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/linux/netfilter/nfnetlink.h
View File

@@ -39,7 +39,6 @@ struct nfnetlink_subsystem {
int (*commit)(struct net *net, struct sk_buff *skb); int (*commit)(struct net *net, struct sk_buff *skb);
int (*abort)(struct net *net, struct sk_buff *skb, int (*abort)(struct net *net, struct sk_buff *skb,
enum nfnl_abort_action action); enum nfnl_abort_action action);
void (*cleanup)(struct net *net);
bool (*valid_genid)(struct net *net, u32 genid); bool (*valid_genid)(struct net *net, u32 genid);
}; };

8
net/netfilter/nf_tables_api.c
View File

@@ -7442,6 +7442,8 @@ static int nf_tables_validate(struct net *net)
if (nft_table_validate(net, table) < 0) if (nft_table_validate(net, table) < 0)
return -EAGAIN; return -EAGAIN;
} }
nft_validate_state_update(net, NFT_VALIDATE_SKIP);
break; break;
} }
@@ -8273,11 +8275,6 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
return 0; return 0;
} }
static void nf_tables_cleanup(struct net *net)
{
nft_validate_state_update(net, NFT_VALIDATE_SKIP);
}
static int nf_tables_abort(struct net *net, struct sk_buff *skb, static int nf_tables_abort(struct net *net, struct sk_buff *skb,
enum nfnl_abort_action action) enum nfnl_abort_action action)
{ {
@@ -8309,7 +8306,6 @@ static const struct nfnetlink_subsystem nf_tables_subsys = {
.cb = nf_tables_cb, .cb = nf_tables_cb,
.commit = nf_tables_commit, .commit = nf_tables_commit,
.abort = nf_tables_abort, .abort = nf_tables_abort,
.cleanup = nf_tables_cleanup,
.valid_genid = nf_tables_valid_genid, .valid_genid = nf_tables_valid_genid,
.owner = THIS_MODULE, .owner = THIS_MODULE,
}; };

2
net/netfilter/nfnetlink.c
View File

@@ -530,8 +530,6 @@ done:
goto replay_abort; goto replay_abort;
} }
} }
if (ss->cleanup)
ss->cleanup(net);
nfnl_err_deliver(&err_list, oskb); nfnl_err_deliver(&err_list, oskb);
kfree_skb(skb); kfree_skb(skb);