diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-06-16 14:45:26 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-06-20 22:43:40 +0200 |
| commit | 26b5a5712eb85e253724e56a54c17f8519bd8e4e (patch) | |
| tree | 88b087c5fb5438d52c62b4758d58450ea00fc219 /net/netfilter/nft_immediate.c | |
| parent | 4bedf9eee016286c835e3d8fa981ddece5338795 (diff) | |
| download | linux-26b5a5712eb85e253724e56a54c17f8519bd8e4e.tar.gz linux-26b5a5712eb85e253724e56a54c17f8519bd8e4e.tar.bz2 linux-26b5a5712eb85e253724e56a54c17f8519bd8e4e.zip | |
netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
Add a new state to deal with rule expressions deactivation from the
newrule error path, otherwise the anonymous set remains in the list in
inactive state for the next generation. Mark the set/chain transaction
as unbound so the abort path releases this object, set it as inactive in
the next generation so it is not reachable anymore from this transaction
and reference counter is dropped.
Fixes: 1240eb93f061 ("netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nft_immediate.c')
| -rw-r--r-- | net/netfilter/nft_immediate.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c index 0492a04064f1..3d76ebfe8939 100644 --- a/net/netfilter/nft_immediate.c +++ b/net/netfilter/nft_immediate.c @@ -150,6 +150,9 @@ static void nft_immediate_deactivate(const struct nft_ctx *ctx, nft_rule_expr_deactivate(&chain_ctx, rule, phase); switch (phase) { + case NFT_TRANS_PREPARE_ERROR: + nf_tables_unbind_chain(ctx, chain); + fallthrough; case NFT_TRANS_PREPARE: nft_deactivate_next(ctx->net, chain); break; |