Commit a23f89a9 authored by Vasily Averin's avatar Vasily Averin Committed by Pablo Neira Ayuso
Browse files

netfilter: conntrack: nf_ct_gre_keymap_flush() removal 



nf_ct_gre_keymap_flush() is useless.
It is called from nf_conntrack_cleanup_net_list() only and tries to remove
nf_ct_gre_keymap entries from pernet gre keymap list. Though:
a) at this point the list should already be empty, all its entries were
deleted during the conntracks cleanup, because
nf_conntrack_cleanup_net_list() executes nf_ct_iterate_cleanup(kill_all)
before nf_conntrack_proto_pernet_fini():
 nf_conntrack_cleanup_net_list
  +- nf_ct_iterate_cleanup
  |   nf_ct_put
  |    nf_conntrack_put
  |     nf_conntrack_destroy
  |      destroy_conntrack
  |       destroy_gre_conntrack
  |        nf_ct_gre_keymap_destroy
  `- nf_conntrack_proto_pernet_fini
      nf_ct_gre_keymap_flush

b) Let's say we find that the keymap list is not empty. This means netns
still has a conntrack associated with gre, in which case we should not free
its memory, because this will lead to a double free and related crashes.
However I doubt it could have gone unnoticed for years, obviously
this does not happen in real life. So I think we can remove
both nf_ct_gre_keymap_flush() and nf_conntrack_proto_pernet_fini().

Signed-off-by: default avatarVasily Averin <vvs@virtuozzo.com>
Acked-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 4ca041f9

include/net/netfilter/nf_conntrack_core.h

+0 −1
Original line number Diff line number Diff line
@@ -30,7 +30,6 @@ void nf_conntrack_cleanup_net(struct net *net); 
void nf_conntrack_cleanup_net_list(struct list_head *net_exit_list);



void nf_conntrack_proto_pernet_init(struct net *net);

void nf_conntrack_proto_pernet_fini(struct net *net);



int nf_conntrack_proto_init(void);

void nf_conntrack_proto_fini(void);

net/netfilter/nf_conntrack_core.c

+0 −1
Original line number Diff line number Diff line
@@ -2457,7 +2457,6 @@ void nf_conntrack_cleanup_net_list(struct list_head *net_exit_list) 
	}



	list_for_each_entry(net, net_exit_list, exit_list) {

		nf_conntrack_proto_pernet_fini(net);

		nf_conntrack_ecache_pernet_fini(net);

		nf_conntrack_expect_pernet_fini(net);

		free_percpu(net->ct.stat);

net/netfilter/nf_conntrack_proto.c

+0 −7
Original line number Diff line number Diff line
@@ -697,13 +697,6 @@ void nf_conntrack_proto_pernet_init(struct net *net) 
#endif

}



void nf_conntrack_proto_pernet_fini(struct net *net)

{

#ifdef CONFIG_NF_CT_PROTO_GRE

	nf_ct_gre_keymap_flush(net);

#endif

}



module_param_call(hashsize, nf_conntrack_set_hashsize, param_get_uint,

		  &nf_conntrack_htable_size, 0600);

net/netfilter/nf_conntrack_proto_gre.c

+0 −13
Original line number Diff line number Diff line
@@ -55,19 +55,6 @@ static inline struct nf_gre_net *gre_pernet(struct net *net) 
	return &net->ct.nf_ct_proto.gre;

}



void nf_ct_gre_keymap_flush(struct net *net)

{

	struct nf_gre_net *net_gre = gre_pernet(net);

	struct nf_ct_gre_keymap *km, *tmp;



	spin_lock_bh(&keymap_lock);

	list_for_each_entry_safe(km, tmp, &net_gre->keymap_list, list) {

		list_del_rcu(&km->list);

		kfree_rcu(km, rcu);

	}

	spin_unlock_bh(&keymap_lock);

}



static inline int gre_key_cmpfn(const struct nf_ct_gre_keymap *km,

				const struct nf_conntrack_tuple *t)

{