nft_compat relies on xt_request_find_match/target to increment refcount of the module that provides the match/target.
The builtin modules/targets currently did't set the module owner so it was possible to rmmod ip(6)tables while extensions were still in use. Signed-off-by: Florian Westphal <[email protected]> --- net/bridge/netfilter/ebtables.c | 1 + net/ipv4/netfilter/ip_tables.c | 3 +++ net/ipv6/netfilter/ip6_tables.c | 3 +++ 3 files changed, 7 insertions(+) diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c index 491828713e0b..a1377db660fe 100644 --- a/net/bridge/netfilter/ebtables.c +++ b/net/bridge/netfilter/ebtables.c @@ -82,6 +82,7 @@ static struct xt_target ebt_standard_target = { .compat_from_user = ebt_standard_compat_from_user, .compat_to_user = ebt_standard_compat_to_user, #endif + .me = THIS_MODULE, }; static inline int diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c index ca0dad90803a..57e7bfc80730 100644 --- a/net/ipv4/netfilter/ip_tables.c +++ b/net/ipv4/netfilter/ip_tables.c @@ -1864,12 +1864,14 @@ static struct xt_target ipt_builtin_tg[] __read_mostly = { .compat_from_user = compat_standard_from_user, .compat_to_user = compat_standard_to_user, #endif + .me = THIS_MODULE, }, { .name = XT_ERROR_TARGET, .target = ipt_error, .targetsize = XT_FUNCTION_MAXNAMELEN, .family = NFPROTO_IPV4, + .me = THIS_MODULE, }, }; @@ -1898,6 +1900,7 @@ static struct xt_match ipt_builtin_mt[] __read_mostly = { .checkentry = icmp_checkentry, .proto = IPPROTO_ICMP, .family = NFPROTO_IPV4, + .me = THIS_MODULE, }, }; diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c index 7eab959734bc..5d21bf5f4319 100644 --- a/net/ipv6/netfilter/ip6_tables.c +++ b/net/ipv6/netfilter/ip6_tables.c @@ -1875,12 +1875,14 @@ static struct xt_target ip6t_builtin_tg[] __read_mostly = { .compat_from_user = compat_standard_from_user, .compat_to_user = compat_standard_to_user, #endif + .me = THIS_MODULE, }, { .name = XT_ERROR_TARGET, .target = ip6t_error, .targetsize = XT_FUNCTION_MAXNAMELEN, .family = NFPROTO_IPV6, + .me = THIS_MODULE, }, }; @@ -1909,6 +1911,7 @@ static struct xt_match ip6t_builtin_mt[] __read_mostly = { .checkentry = icmp6_checkentry, .proto = IPPROTO_ICMPV6, .family = NFPROTO_IPV6, + .me = THIS_MODULE, }, }; -- 2.16.4 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
