Commit 25e04194 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Wen Zhiwei
Browse files

netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path 

stable inclusion
from stable-v6.6.54
commit da2bb8e177a46f23ca5a0586173b2240fef86078
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IAZ3K2

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=da2bb8e177a46f23ca5a0586173b2240fef86078



--------------------------------

[ Upstream commit 4ffcf5ca81c3b83180473eb0d3c010a1a7c6c4de ]

Lockless iteration over hook list is possible from netlink dump path,
use rcu variant to iterate over the hook list as is done with flowtable
hooks.

Fixes: b9703ed4 ("netfilter: nf_tables: support for adding new devices to an existing netdev chain")
Reported-by: default avatarPhil Sutter <phil@nwl.cc>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarWen Zhiwei <wenzhiwei@kylinos.cn>
parent 352a1814

net/netfilter/nf_tables_api.c

+1 −1
Original line number Diff line number Diff line
@@ -1778,7 +1778,7 @@ static int nft_dump_basechain_hook(struct sk_buff *skb, int family, 
		if (!hook_list)

			hook_list = &basechain->hook_list;



		list_for_each_entry(hook, hook_list, list) {

		list_for_each_entry_rcu(hook, hook_list, list) {

			if (!first)

				first = hook;