leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netfilter: nf_tables: fix register ordering

Browse Source 
We must register nfnetlink ops last, as that exposes nf_tables to
userspace.  Without this, we could theoretically get nfnetlink request
before net->nft state has been initialized.

Fixes: 99633ab29b ("netfilter: nf_tables: complete net namespace support")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2018-08-02 21:44:40 +02:00 committed by Pablo Neira Ayuso
parent 3e673b23b5
commit d209df3e7f
3 changed files with 25 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/net/netfilter/nf_tables.h
View File

@ -1374,6 +1374,6 @@ struct nft_trans_flowtable {
(((struct nft_trans_flowtable *)trans->data)->flowtable)
int __init nft_chain_filter_init(void);
void __exit nft_chain_filter_fini(void);
void nft_chain_filter_fini(void);
#endif /* _NET_NF_TABLES_H */

31
net/netfilter/nf_tables_api.c
View File

@ -7273,21 +7273,36 @@ static int __init nf_tables_module_init(void)
{
int err;
nft_chain_filter_init();
err = nf_tables_core_module_init();
err = register_pernet_subsys(&nf_tables_net_ops);
if (err < 0)
return err;
err = nft_chain_filter_init();
if (err < 0)
goto err1;
err = nf_tables_core_module_init();
if (err < 0)
goto err2;
err = register_netdevice_notifier(&nf_tables_flowtable_notifier);
if (err < 0)
goto err3;
/* must be last */
err = nfnetlink_subsys_register(&nf_tables_subsys);
if (err < 0)
goto err;
goto err4;
register_netdevice_notifier(&nf_tables_flowtable_notifier);
return register_pernet_subsys(&nf_tables_net_ops);
err:
return err;
err4:
unregister_netdevice_notifier(&nf_tables_flowtable_notifier);
err3:
nf_tables_core_module_exit();
err2:
nft_chain_filter_fini();
err1:
unregister_pernet_subsys(&nf_tables_net_ops);
return err;
}

2
net/netfilter/nft_chain_filter.c
View File

@ -392,7 +392,7 @@ int __init nft_chain_filter_init(void)
return 0;
}
void __exit nft_chain_filter_fini(void)
void nft_chain_filter_fini(void)
{
nft_chain_filter_bridge_fini();
nft_chain_filter_inet_fini();