Commit 9b05b6e1 authored by Laura Garcia Liebana's avatar Laura Garcia Liebana Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: bogus EBUSY when deleting flowtable after flush 



The deletion of a flowtable after a flush in the same transaction
results in EBUSY. This patch adds an activation and deactivation of
flowtables in order to update the _use_ counter.

Signed-off-by: default avatarLaura Garcia Liebana <nevola@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 20ff1cb5

include/net/netfilter/nf_tables.h

+4 −0
Original line number Diff line number Diff line
@@ -1183,6 +1183,10 @@ struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table, 
					   const struct nlattr *nla,

					   u8 genmask);



void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,

				    struct nft_flowtable *flowtable,

				    enum nft_trans_phase phase);



void nft_register_flowtable_type(struct nf_flowtable_type *type);

void nft_unregister_flowtable_type(struct nf_flowtable_type *type);

net/netfilter/nf_tables_api.c

+16 −0
Original line number Diff line number Diff line
@@ -5598,6 +5598,22 @@ struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table, 
}

EXPORT_SYMBOL_GPL(nft_flowtable_lookup);



void nf_tables_deactivate_flowtable(const struct nft_ctx *ctx,

				    struct nft_flowtable *flowtable,

				    enum nft_trans_phase phase)

{

	switch (phase) {

	case NFT_TRANS_PREPARE:

	case NFT_TRANS_ABORT:

	case NFT_TRANS_RELEASE:

		flowtable->use--;

		/* fall through */

	default:

		return;

	}

}

EXPORT_SYMBOL_GPL(nf_tables_deactivate_flowtable);



static struct nft_flowtable *

nft_flowtable_lookup_byhandle(const struct nft_table *table,

			      const struct nlattr *nla, u8 genmask)

net/netfilter/nft_flow_offload.c

+19 −0
Original line number Diff line number Diff line
@@ -177,6 +177,23 @@ static int nft_flow_offload_init(const struct nft_ctx *ctx, 
	return nf_ct_netns_get(ctx->net, ctx->family);

}



static void nft_flow_offload_deactivate(const struct nft_ctx *ctx,

					const struct nft_expr *expr,

					enum nft_trans_phase phase)

{

	struct nft_flow_offload *priv = nft_expr_priv(expr);



	nf_tables_deactivate_flowtable(ctx, priv->flowtable, phase);

}



static void nft_flow_offload_activate(const struct nft_ctx *ctx,

				      const struct nft_expr *expr)

{

	struct nft_flow_offload *priv = nft_expr_priv(expr);



	priv->flowtable->use++;

}



static void nft_flow_offload_destroy(const struct nft_ctx *ctx,

				     const struct nft_expr *expr)

{
@@ -205,6 +222,8 @@ static const struct nft_expr_ops nft_flow_offload_ops = { 
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_flow_offload)),

	.eval		= nft_flow_offload_eval,

	.init		= nft_flow_offload_init,

	.activate	= nft_flow_offload_activate,

	.deactivate	= nft_flow_offload_deactivate,

	.destroy	= nft_flow_offload_destroy,

	.validate	= nft_flow_offload_validate,

	.dump		= nft_flow_offload_dump,

CRA Git | Maintained and supported by SUSTech CRA and CCSE