Commit d209df3e authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: fix register ordering 



We must register nfnetlink ops last, as that exposes nf_tables to
userspace.  Without this, we could theoretically get nfnetlink request
before net->nft state has been initialized.

Fixes: 99633ab2 ("netfilter: nf_tables: complete net namespace support")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 3e673b23

include/net/netfilter/nf_tables.h

+1 −1
Original line number Diff line number Diff line
@@ -1374,6 +1374,6 @@ struct nft_trans_flowtable { 
	(((struct nft_trans_flowtable *)trans->data)->flowtable)



int __init nft_chain_filter_init(void);

void __exit nft_chain_filter_fini(void);

void nft_chain_filter_fini(void);



#endif /* _NET_NF_TABLES_H */

net/netfilter/nf_tables_api.c

+22 −7
Original line number Diff line number Diff line
@@ -7273,21 +7273,36 @@ static int __init nf_tables_module_init(void) 
{

	int err;



	nft_chain_filter_init();

	err = register_pernet_subsys(&nf_tables_net_ops);

	if (err < 0)

		return err;



	err = nft_chain_filter_init();

	if (err < 0)

		goto err1;



	err = nf_tables_core_module_init();

	if (err < 0)

		return err;

		goto err2;



	err = nfnetlink_subsys_register(&nf_tables_subsys);

	err = register_netdevice_notifier(&nf_tables_flowtable_notifier);

	if (err < 0)

		goto err;

		goto err3;



	register_netdevice_notifier(&nf_tables_flowtable_notifier);

	/* must be last */

	err = nfnetlink_subsys_register(&nf_tables_subsys);

	if (err < 0)

		goto err4;



	return register_pernet_subsys(&nf_tables_net_ops);

err:

	return err;

err4:

	unregister_netdevice_notifier(&nf_tables_flowtable_notifier);

err3:

	nf_tables_core_module_exit();

err2:

	nft_chain_filter_fini();

err1:

	unregister_pernet_subsys(&nf_tables_net_ops);

	return err;

}

net/netfilter/nft_chain_filter.c

+1 −1
Original line number Diff line number Diff line
@@ -392,7 +392,7 @@ int __init nft_chain_filter_init(void) 
	return 0;

}



void __exit nft_chain_filter_fini(void)

void nft_chain_filter_fini(void)

{

	nft_chain_filter_bridge_fini();

	nft_chain_filter_inet_fini();

CRA Git | Maintained and supported by SUSTech CRA and CCSE