]> www.infradead.org Git - users/dwmw2/linux.git/commit
netfilter: nf_tables: imbalance in flowtable binding
authorPablo Neira Ayuso <pablo@netfilter.org>
Thu, 2 Jan 2025 12:01:13 +0000 (13:01 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Thu, 9 Jan 2025 12:29:38 +0000 (13:29 +0100)
commit13210fc63f353fe78584048079343413a3cdf819
treec4b9e5bde910e164ef0e9657a13c8a7aac9d9884
parent4f619d518db9cd1a933c3a095a5f95d0c1584ae8
netfilter: nf_tables: imbalance in flowtable binding

All these cases cause imbalance between BIND and UNBIND calls:

- Delete an interface from a flowtable with multiple interfaces

- Add a (device to a) flowtable with --check flag

- Delete a netns containing a flowtable

- In an interactive nft session, create a table with owner flag and
  flowtable inside, then quit.

Fix it by calling FLOW_BLOCK_UNBIND when unregistering hooks, then
remove late FLOW_BLOCK_UNBIND call when destroying flowtable.

Fixes: ff4bf2f42a40 ("netfilter: nf_tables: add nft_unregister_flowtable_hook()")
Reported-by: Phil Sutter <phil@nwl.cc>
Tested-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_tables_api.c