Commit 997fe24d authored by Phil Sutter's avatar Phil Sutter Committed by Wen Zhiwei
Browse files

netfilter: nf_tables: Keep deleted flowtable hooks until after RCU 

stable inclusion
from stable-v6.6.54
commit 668f4df6d6df17330e35f434b1f0633709f5fb33
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IAZ3K2

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=668f4df6d6df17330e35f434b1f0633709f5fb33



--------------------------------

[ Upstream commit 642c89c475419b4d0c0d90e29d9c1a0e4351f379 ]

Documentation of list_del_rcu() warns callers to not immediately free
the deleted list item. While it seems not necessary to use the
RCU-variant of list_del() here in the first place, doing so seems to
require calling kfree_rcu() on the deleted item as well.

Fixes: 3f0465a9 ("netfilter: nf_tables: dynamically allocate hooks per net_device in flowtables")
Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarWen Zhiwei <wenzhiwei@kylinos.cn>
parent 54254e64

net/netfilter/nf_tables_api.c

+1 −1
Original line number Diff line number Diff line
@@ -8943,7 +8943,7 @@ static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) 
		flowtable->data.type->setup(&flowtable->data, hook->ops.dev,

					    FLOW_BLOCK_UNBIND);

		list_del_rcu(&hook->list);

		kfree(hook);

		kfree_rcu(hook, rcu);

	}

	kfree(flowtable->name);

	module_put(flowtable->data.type->owner);