brain-hackers_pepepper-mirror
/
linux-brain
mirror of https://github.com/brain-hackers/linux-brain.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

netfilter: arp_tables: add pre_exit hook for table unregister 

commit d163a925ebbc6eb5b562b0f1d72c7e817aa75c40 upstream.

Same problem that also existed in iptables/ip(6)tables, when
arptable_filter is removed there is no longer a wait period before the
table/ruleset is free'd.

Unregister the hook in pre_exit, then remove the table in the exit
function.
This used to work correctly because the old nf_hook_unregister API
did unconditional synchronize_net.

The per-net hook unregister function uses call_rcu instead.

Fixes: b9e69e1273 ("netfilter: xtables: don't hook tables by default")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Florian Westphal 2021-04-07 21:43:40 +02:00 committed by Greg Kroah-Hartman
parent ce23be37ec
commit 6449b405f9
3 changed files with 19 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
include/linux/netfilter_arp/arp_tables.h
View File

@ -52,8 +52,9 @@ extern void *arpt_alloc_initial_table(const struct xt_table *);
int arpt_register_table(struct net *net, const struct xt_table *table, int arpt_register_table(struct net *net, const struct xt_table *table,
const struct arpt_replace *repl, const struct arpt_replace *repl,
const struct nf_hook_ops *ops, struct xt_table **res); const struct nf_hook_ops *ops, struct xt_table **res);
void arpt_unregister_table(struct net *net, struct xt_table *table, void arpt_unregister_table(struct net *net, struct xt_table *table);
const struct nf_hook_ops *ops); void arpt_unregister_table_pre_exit(struct net *net, struct xt_table *table,
const struct nf_hook_ops *ops);
extern unsigned int arpt_do_table(struct sk_buff *skb, extern unsigned int arpt_do_table(struct sk_buff *skb,
const struct nf_hook_state *state, const struct nf_hook_state *state,
struct xt_table *table); struct xt_table *table);

9
net/ipv4/netfilter/arp_tables.c
View File

@ -1580,10 +1580,15 @@ out_free:
return ret; return ret;
} }
void arpt_unregister_table(struct net *net, struct xt_table *table, void arpt_unregister_table_pre_exit(struct net *net, struct xt_table *table,
const struct nf_hook_ops *ops) const struct nf_hook_ops *ops)
{ {
nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks)); nf_unregister_net_hooks(net, ops, hweight32(table->valid_hooks));
}
EXPORT_SYMBOL(arpt_unregister_table_pre_exit);
void arpt_unregister_table(struct net *net, struct xt_table *table)
{
__arpt_unregister_table(net, table); __arpt_unregister_table(net, table);
} }

10
net/ipv4/netfilter/arptable_filter.c
View File

@ -56,16 +56,24 @@ static int __net_init arptable_filter_table_init(struct net *net)
return err; return err;
} }
static void __net_exit arptable_filter_net_pre_exit(struct net *net)
{
if (net->ipv4.arptable_filter)
arpt_unregister_table_pre_exit(net, net->ipv4.arptable_filter,
arpfilter_ops);
}
static void __net_exit arptable_filter_net_exit(struct net *net) static void __net_exit arptable_filter_net_exit(struct net *net)
{ {
if (!net->ipv4.arptable_filter) if (!net->ipv4.arptable_filter)
return; return;
arpt_unregister_table(net, net->ipv4.arptable_filter, arpfilter_ops); arpt_unregister_table(net, net->ipv4.arptable_filter);
net->ipv4.arptable_filter = NULL; net->ipv4.arptable_filter = NULL;
} }
static struct pernet_operations arptable_filter_net_ops = { static struct pernet_operations arptable_filter_net_ops = {
.exit = arptable_filter_net_exit, .exit = arptable_filter_net_exit,
.pre_exit = arptable_filter_net_pre_exit,
}; };
static int __init arptable_filter_init(void) static int __init arptable_filter_init(void)