[PATCH 2/2 nf] netfilter: nf_tables: do not hold reference on netdevice from preparation phase

[Pablo Neira Ayuso]

The netfilter netdevice event handlers hold the nfnl_lock mutex, this
avoid a race with devices going away while a device is being attached to
hooks from the netlink control plane. Therefore, control plane bails
out with ENOENT or netdevice event path waits until the hook that is
attached to net_device is registered.

Signed-off-by: Pablo Neira Ayuso <pa...@netfilter.org>
---
 net/netfilter/nf_tables_api.c | 19 ++++---------------
 1 file changed, 4 insertions(+), 15 deletions(-)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 977d43e00f98..530e12ae52d7 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1288,8 +1288,6 @@ static void nf_tables_chain_destroy(struct nft_chain 
*chain)
                free_percpu(basechain->stats);
                if (basechain->stats)
                        static_branch_dec(&nft_counters_enabled);
-               if (basechain->ops.dev != NULL)
-                       dev_put(basechain->ops.dev);
                kfree(chain->name);
                kfree(basechain);
        } else {
@@ -1356,7 +1354,7 @@ static int nft_chain_parse_hook(struct net *net,
                }
 
                nla_strlcpy(ifname, ha[NFTA_HOOK_DEV], IFNAMSIZ);
-               dev = dev_get_by_name(net, ifname);
+               dev = __dev_get_by_name(net, ifname);
                if (!dev) {
                        module_put(type->owner);
                        return -ENOENT;
@@ -1373,8 +1371,6 @@ static int nft_chain_parse_hook(struct net *net,
 static void nft_chain_release_hook(struct nft_chain_hook *hook)
 {
        module_put(hook->type->owner);
-       if (hook->dev != NULL)
-               dev_put(hook->dev);
 }
 
 static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask,
@@ -4948,7 +4944,7 @@ static int nf_tables_parse_devices(const struct nft_ctx 
*ctx,
                }
 
                nla_strlcpy(ifname, tmp, IFNAMSIZ);
-               dev = dev_get_by_name(ctx->net, ifname);
+               dev = __dev_get_by_name(ctx->net, ifname);
                if (!dev) {
                        err = -ENOENT;
                        goto err1;
@@ -5007,10 +5003,8 @@ static int nf_tables_flowtable_parse_hook(const struct 
nft_ctx *ctx,
                return err;
 
        ops = kzalloc(sizeof(struct nf_hook_ops) * n, GFP_KERNEL);
-       if (!ops) {
-               err = -ENOMEM;
-               goto err1;
-       }
+       if (!ops)
+               return -ENOMEM;
 
        flowtable->hooknum      = hooknum;
        flowtable->priority     = priority;
@@ -5028,11 +5022,6 @@ static int nf_tables_flowtable_parse_hook(const struct 
nft_ctx *ctx,
                                                          GFP_KERNEL);
        }
 
-       err = 0;
-err1:
-       for (i = 0; i < n; i++)
-               dev_put(dev_array[i]);
-
        return err;
 }
 
-- 
2.11.0

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html