shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-05 18:41:58 +09:00
Code Issues Packages Projects Releases Wiki Activity

UPSTREAM: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain

Browse Source 
commit 01acb2e8666a6529697141a6017edbf206921913 upstream.

Remove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER
event is reported, otherwise a stale reference to netdevice remains in
the hook list.

Bug: 332803585
Fixes: 60a3815da7 ("netfilter: add inet ingress support")
Cc: stable@vger.kernel.org
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 70f17b48c8)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I28482dca416b61dcf2e722ba0aef62d2d41a8f23
This commit is contained in:
Pablo Neira Ayuso
2024-01-18 10:56:26 +01:00
committed by Treehugger Robot
parent 5b4439c0d7
commit cdc8aeb893
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
net/netfilter/nft_chain_filter.c
View File

@@ -357,9 +357,10 @@ static int nf_tables_netdev_event(struct notifier_block *this,
unsigned long event, void *ptr) unsigned long event, void *ptr)
{ {
struct net_device *dev = netdev_notifier_info_to_dev(ptr); struct net_device *dev = netdev_notifier_info_to_dev(ptr);
struct nft_base_chain *basechain;
struct nftables_pernet *nft_net; struct nftables_pernet *nft_net;
struct nft_table *table;
struct nft_chain *chain, *nr; struct nft_chain *chain, *nr;
struct nft_table *table;
struct nft_ctx ctx = { struct nft_ctx ctx = {
.net = dev_net(dev), .net = dev_net(dev),
}; };
@@ -371,7 +372,8 @@ static int nf_tables_netdev_event(struct notifier_block *this,
nft_net = nft_pernet(ctx.net); nft_net = nft_pernet(ctx.net);
mutex_lock(&nft_net->commit_mutex); mutex_lock(&nft_net->commit_mutex);
list_for_each_entry(table, &nft_net->tables, list) { list_for_each_entry(table, &nft_net->tables, list) {
if (table->family != NFPROTO_NETDEV) if (table->family != NFPROTO_NETDEV &&
table->family != NFPROTO_INET)
continue; continue;
ctx.family = table->family; ctx.family = table->family;
@@ -380,6 +382,11 @@ static int nf_tables_netdev_event(struct notifier_block *this,
if (!nft_is_base_chain(chain)) if (!nft_is_base_chain(chain))
continue; continue;
basechain = nft_base_chain(chain);
if (table->family == NFPROTO_INET &&
basechain->ops.hooknum != NF_INET_INGRESS)
continue;
ctx.chain = chain; ctx.chain = chain;
nft_netdev_event(event, dev, &ctx); nft_netdev_event(event, dev, &ctx);
} }