netfilter: nf_tables: delete flowtable hooks via transaction list

BugLink: https://bugs.launchpad.net/bugs/1982968
[ Upstream commit b6d9014a3335194590abdd2a2471ef5147a67645 ]

Remove inactive bool field in nft_hook object that was introduced in
abadb2f865d7 ("netfilter: nf_tables: delete devices from flowtable").
Move stale flowtable hooks to transaction list instead.

Deleting twice the same device does not result in ENOENT.

Fixes: abadb2f865d7 ("netfilter: nf_tables: delete devices from flowtable")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index d52a5d776e764e1214873c064c8b790e09b332ee..2af1c2c64128e9f7124ae086850abfd752e9b39a 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1053,7 +1053,6 @@ struct nft_stats {
 
 struct nft_hook {
        struct list_head        list;
-       bool                    inactive;
        struct nf_hook_ops      ops;
        struct rcu_head         rcu;
 };

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 135f7b09d61726d242429acaf229363666fca430..f093e837b55dc507abe6c8a612c663bc076114b0 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1835,7 +1835,6 @@ static struct nft_hook *nft_netdev_hook_alloc(struct net *net,
                goto err_hook_dev;
        }
        hook->ops.dev = dev;
-       hook->inactive = false;
 
        return hook;
 
@@ -7531,6 +7530,7 @@ static int nft_delflowtable_hook(struct nft_ctx *ctx,
 {
        const struct nlattr * const *nla = ctx->nla;
        struct nft_flowtable_hook flowtable_hook;
+       LIST_HEAD(flowtable_del_list);
        struct nft_hook *this, *hook;
        struct nft_trans *trans;
        int err;
@@ -7546,7 +7546,7 @@ static int nft_delflowtable_hook(struct nft_ctx *ctx,
                        err = -ENOENT;
                        goto err_flowtable_del_hook;
                }
-               hook->inactive = true;
+               list_move(&hook->list, &flowtable_del_list);
        }
 
        trans = nft_trans_alloc(ctx, NFT_MSG_DELFLOWTABLE,
@@ -7559,6 +7559,7 @@ static int nft_delflowtable_hook(struct nft_ctx *ctx,
        nft_trans_flowtable(trans) = flowtable;
        nft_trans_flowtable_update(trans) = true;
        INIT_LIST_HEAD(&nft_trans_flowtable_hooks(trans));
+       list_splice(&flowtable_del_list, &nft_trans_flowtable_hooks(trans));
        nft_flowtable_hook_release(&flowtable_hook);
 
        nft_trans_commit_list_add_tail(ctx->net, trans);
@@ -7566,13 +7567,7 @@ static int nft_delflowtable_hook(struct nft_ctx *ctx,
        return 0;
 
 err_flowtable_del_hook:
-       list_for_each_entry(this, &flowtable_hook.list, list) {
-               hook = nft_hook_list_find(&flowtable->hook_list, this);
-               if (!hook)
-                       break;
-
-               hook->inactive = false;
-       }
+       list_splice(&flowtable_del_list, &flowtable->hook_list);
        nft_flowtable_hook_release(&flowtable_hook);
 
        return err;
@@ -8427,17 +8422,6 @@ void nft_chain_del(struct nft_chain *chain)
        list_del_rcu(&chain->list);
 }
 
-static void nft_flowtable_hooks_del(struct nft_flowtable *flowtable,
-                                   struct list_head *hook_list)
-{
-       struct nft_hook *hook, *next;
-
-       list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) {
-               if (hook->inactive)
-                       list_move(&hook->list, hook_list);
-       }
-}
-
 static void nf_tables_module_autoload_cleanup(struct net *net)
 {
        struct nftables_pernet *nft_net = nft_pernet(net);
@@ -8782,8 +8766,6 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
                        break;
                case NFT_MSG_DELFLOWTABLE:
                        if (nft_trans_flowtable_update(trans)) {
-                               nft_flowtable_hooks_del(nft_trans_flowtable(trans),
-                                                       &nft_trans_flowtable_hooks(trans));
                                nf_tables_flowtable_notify(&trans->ctx,
                                                           nft_trans_flowtable(trans),
                                                           &nft_trans_flowtable_hooks(trans),
@@ -8864,7 +8846,6 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
        struct nftables_pernet *nft_net = nft_pernet(net);
        struct nft_trans *trans, *next;
        struct nft_trans_elem *te;
-       struct nft_hook *hook;
 
        if (action == NFNL_ABORT_VALIDATE &&
            nf_tables_validate(net) < 0)
@@ -8995,8 +8976,8 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
                        break;
                case NFT_MSG_DELFLOWTABLE:
                        if (nft_trans_flowtable_update(trans)) {
-                               list_for_each_entry(hook, &nft_trans_flowtable(trans)->hook_list, list)
-                                       hook->inactive = false;
+                               list_splice(&nft_trans_flowtable_hooks(trans),
+                                           &nft_trans_flowtable(trans)->hook_list);
                        } else {
                                trans->ctx.table->use++;
                                nft_clear(trans->ctx.net, nft_trans_flowtable(trans));