niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

net/sched: act_ct: remove and free nf_table callbacks

Browse source 
When cleaning up the nf_table in tcf_ct_flow_table_cleanup_work
there is no guarantee that the callback list, added to by
nf_flow_table_offload_add_cb, is empty. This means that it is
possible that the flow_block_cb memory allocated will be lost.

Fix this by iterating the list and freeing the flow_block_cb entries
before freeing the nf_table entry (via freeing ct_ft).

Fixes: 978703f425 ("netfilter: flowtable: Add API for registering to flow table events")
Signed-off-by: Louis Peens <louis.peens@corigine.com>
Signed-off-by: Yinjun Zhang <yinjun.zhang@corigine.com>
Signed-off-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Louis Peens 2021-07-02 11:21:38 +02:00 • committed by David S. Miller
parent a019abd802
commit 77ac5e40c4
1 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
net/sched/act_ct.c
View file

@ -322,11 +322,22 @@ err_alloc:
static void tcf_ct_flow_table_cleanup_work(struct work_struct *work) static void tcf_ct_flow_table_cleanup_work(struct work_struct *work)
{ {
struct flow_block_cb *block_cb, *tmp_cb;
struct tcf_ct_flow_table *ct_ft; struct tcf_ct_flow_table *ct_ft;
struct flow_block *block;
ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table, ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table,
rwork); rwork);
nf_flow_table_free(&ct_ft->nf_ft); nf_flow_table_free(&ct_ft->nf_ft);
/* Remove any remaining callbacks before cleanup */
block = &ct_ft->nf_ft.flow_block;
down_write(&ct_ft->nf_ft.flow_block_lock);
list_for_each_entry_safe(block_cb, tmp_cb, &block->cb_list, list) {
list_del(&block_cb->list);
flow_block_cb_free(block_cb);
}
up_write(&ct_ft->nf_ft.flow_block_lock);
kfree(ct_ft); kfree(ct_ft);
module_put(THIS_MODULE); module_put(THIS_MODULE);