* [PATCH nf] netfilter: ipset: pernet ops must be unregistered last
@ 2017-09-25 22:44 Florian Westphal
2017-09-26 7:49 ` Jozsef Kadlecsik
0 siblings, 1 reply; 2+ messages in thread
From: Florian Westphal @ 2017-09-25 22:44 UTC (permalink / raw)
To: netfilter-devel; +Cc: Florian Westphal
Removing the ipset module leaves a small window where one cpu performs
module removal while another runs a command like 'ipset flush'.
ipset uses net_generic(), unregistering the pernet ops frees this
storage area.
Fix it by first removing the user-visible api handlers and the pernet
ops last.
Fixes: 1785e8f473082 ("netfiler: ipset: Add net namespace for ipset")
Reported-by: Li Shuang <shuali@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
net/netfilter/ipset/ip_set_core.c | 23 +++++++++++++----------
1 file changed, 13 insertions(+), 10 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index e495b5e484b1..5ec7740c2088 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -2072,25 +2072,27 @@ static struct pernet_operations ip_set_net_ops = {
static int __init
ip_set_init(void)
{
- int ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
+ int ret = register_pernet_subsys(&ip_set_net_ops);
+ if (ret) {
+ pr_err("ip_set: cannot register pernet_subsys.\n");
+ return ret;
+ }
+ ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
if (ret != 0) {
pr_err("ip_set: cannot register with nfnetlink.\n");
+ unregister_pernet_subsys(&ip_set_net_ops);
return ret;
}
+
ret = nf_register_sockopt(&so_set);
if (ret != 0) {
pr_err("SO_SET registry failed: %d\n", ret);
nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
+ unregister_pernet_subsys(&ip_set_net_ops);
return ret;
}
- ret = register_pernet_subsys(&ip_set_net_ops);
- if (ret) {
- pr_err("ip_set: cannot register pernet_subsys.\n");
- nf_unregister_sockopt(&so_set);
- nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
- return ret;
- }
+
pr_info("ip_set: protocol %u\n", IPSET_PROTOCOL);
return 0;
}
@@ -2098,9 +2100,10 @@ ip_set_init(void)
static void __exit
ip_set_fini(void)
{
- unregister_pernet_subsys(&ip_set_net_ops);
- nf_unregister_sockopt(&so_set);
nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
+ nf_unregister_sockopt(&so_set);
+
+ unregister_pernet_subsys(&ip_set_net_ops);
pr_debug("these are the famous last words\n");
}
--
2.13.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH nf] netfilter: ipset: pernet ops must be unregistered last
2017-09-25 22:44 [PATCH nf] netfilter: ipset: pernet ops must be unregistered last Florian Westphal
@ 2017-09-26 7:49 ` Jozsef Kadlecsik
0 siblings, 0 replies; 2+ messages in thread
From: Jozsef Kadlecsik @ 2017-09-26 7:49 UTC (permalink / raw)
To: Florian Westphal; +Cc: netfilter-devel
Hi Florian,
On Tue, 26 Sep 2017, Florian Westphal wrote:
> Removing the ipset module leaves a small window where one cpu performs
> module removal while another runs a command like 'ipset flush'.
>
> ipset uses net_generic(), unregistering the pernet ops frees this
> storage area.
>
> Fix it by first removing the user-visible api handlers and the pernet
> ops last.
>
> Fixes: 1785e8f473082 ("netfiler: ipset: Add net namespace for ipset")
> Reported-by: Li Shuang <shuali@redhat.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
> net/netfilter/ipset/ip_set_core.c | 23 +++++++++++++----------
> 1 file changed, 13 insertions(+), 10 deletions(-)
>
> diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
> index e495b5e484b1..5ec7740c2088 100644
> --- a/net/netfilter/ipset/ip_set_core.c
> +++ b/net/netfilter/ipset/ip_set_core.c
> @@ -2072,25 +2072,27 @@ static struct pernet_operations ip_set_net_ops = {
> static int __init
> ip_set_init(void)
> {
> - int ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
> + int ret = register_pernet_subsys(&ip_set_net_ops);
> + if (ret) {
> + pr_err("ip_set: cannot register pernet_subsys.\n");
> + return ret;
> + }
>
> + ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
> if (ret != 0) {
> pr_err("ip_set: cannot register with nfnetlink.\n");
> + unregister_pernet_subsys(&ip_set_net_ops);
> return ret;
> }
> +
> ret = nf_register_sockopt(&so_set);
> if (ret != 0) {
> pr_err("SO_SET registry failed: %d\n", ret);
> nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
> + unregister_pernet_subsys(&ip_set_net_ops);
> return ret;
> }
> - ret = register_pernet_subsys(&ip_set_net_ops);
> - if (ret) {
> - pr_err("ip_set: cannot register pernet_subsys.\n");
> - nf_unregister_sockopt(&so_set);
> - nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
> - return ret;
> - }
> +
> pr_info("ip_set: protocol %u\n", IPSET_PROTOCOL);
> return 0;
> }
> @@ -2098,9 +2100,10 @@ ip_set_init(void)
> static void __exit
> ip_set_fini(void)
> {
> - unregister_pernet_subsys(&ip_set_net_ops);
> - nf_unregister_sockopt(&so_set);
> nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
> + nf_unregister_sockopt(&so_set);
> +
> + unregister_pernet_subsys(&ip_set_net_ops);
> pr_debug("these are the famous last words\n");
> }
Following the registration sequence in backward order, shouldn't first the
sockopt, then the netlink_subsys be unregistered? Even if it doesn't
matter, I think it'd be more consistent.
Best regards,
Jozsef
-
E-mail : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.mta.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences
H-1525 Budapest 114, POB. 49, Hungary
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-09-26 7:49 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-09-25 22:44 [PATCH nf] netfilter: ipset: pernet ops must be unregistered last Florian Westphal
2017-09-26 7:49 ` Jozsef Kadlecsik
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.