summaryrefslogtreecommitdiff
path: root/net/netfilter/nf_conntrack_proto.c
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2018-08-02 21:44:41 +0200
committerPablo Neira Ayuso <pablo@netfilter.org>2018-08-16 19:37:03 +0200
commit6a48de0144767f2c6880540c0a4ac6741e3c440b (patch)
treef3111dac7df6aa291d8d8b60dcb50f5a508c9d70 /net/netfilter/nf_conntrack_proto.c
parentd209df3e7f7002d9099fdb0f6df0f972b4386a63 (diff)
netfilter: nf_tables: don't prevent event handler from device cleanup on netns exit
When a netnsamespace exits, the nf_tables pernet_ops will remove all rules. However, there is one caveat: Base chains that register ingress hooks will cause use-after-free: device is already gone at that point. The device event handlers prevent this from happening: netns exit synthesizes unregister events for all devices. However, an improper fix for a race condition made the notifiers a no-op in case they get called from netns exit path, so revert that part. This is safe now as the previous patch fixed nf_tables pernet ops and device notifier initialisation ordering. Fixes: 0a2cf5ee432c2 ("netfilter: nf_tables: close race between netns exit and rmmod") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nf_conntrack_proto.c')
0 files changed, 0 insertions, 0 deletions