netfilter: conntrack: fix removal of conntrack entries when l4tracker is removed (1c117d3b) · Commits · 戴 / test

nf_ct_l4proto_unregister_one() leaves conntracks added by to-be-removed tracker behind, nf_ct_l4proto_unregister has to iterate for each protocol to be removed. v2: call nf_ct_iterate_destroy without holding nf_ct_proto_mutex. Fixes: ("netfilter: move table iteration out of netns exit paths") Signed-off-by:

Florian Westphal <fw@strlen.de> Signed-off-by:

Pablo Neira Ayuso <pablo@netfilter.org>

net/netfilter/nf_conntrack_proto.c

+10 −5

Original line number	Diff line number	Diff line
		@@ -312,7 +312,9 @@ void nf_ct_l4proto_unregister_one(const struct nf_conntrack_l4proto *l4proto)
		__nf_ct_l4proto_unregister_one(l4proto);
		mutex_unlock(&nf_ct_proto_mutex);

		synchronize_rcu();
		synchronize_net();
		/* Remove all contrack entries for this protocol */
		nf_ct_iterate_destroy(kill_l4proto, (void *)l4proto);
		}
		EXPORT_SYMBOL_GPL(nf_ct_l4proto_unregister_one);

		@@ -333,14 +335,17 @@ static void
		nf_ct_l4proto_unregister(const struct nf_conntrack_l4proto * const l4proto[],
		unsigned int num_proto)
		{
		int i;

		mutex_lock(&nf_ct_proto_mutex);
		while (num_proto-- != 0)
		__nf_ct_l4proto_unregister_one(l4proto[num_proto]);
		for (i = 0; i < num_proto; i++)
		__nf_ct_l4proto_unregister_one(l4proto[i]);
		mutex_unlock(&nf_ct_proto_mutex);

		synchronize_net();
		/* Remove all contrack entries for this protocol */
		nf_ct_iterate_destroy(kill_l4proto, (void *)l4proto);

		for (i = 0; i < num_proto; i++)
		nf_ct_iterate_destroy(kill_l4proto, (void *)l4proto[i]);
		}

		static int

Admin message