* [PATCH nf-next] netfilter: nf_tables_offload: Fix unbind devices when subsequent device bind failed
@ 2019-10-24 3:55 wenxu
2019-10-24 9:25 ` Pablo Neira Ayuso
0 siblings, 1 reply; 2+ messages in thread
From: wenxu @ 2019-10-24 3:55 UTC (permalink / raw)
To: fw, pablo; +Cc: netfilter-devel
From: wenxu <wenxu@ucloud.cn>
In the nft_flow_block_chain some devices bind success, but the subsequent
device failed. It should unbind the successful devices.
Fixes: bbaef955af6e ("netfilter: nf_tables: support for multiple devices per netdev hook")
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
net/netfilter/nf_tables_offload.c | 25 +++++++++++++++++++++----
1 file changed, 21 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index beeb74f..037c6bd 100644
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -322,8 +322,9 @@ static int nft_flow_block_chain(struct nft_base_chain *basechain,
{
struct net_device *dev;
struct nft_hook *hook;
- int err;
+ int err, i;
+ i = 0;
list_for_each_entry(hook, &basechain->hook_list, list) {
dev = hook->ops.dev;
if (this_dev && this_dev != dev)
@@ -333,12 +334,28 @@ static int nft_flow_block_chain(struct nft_base_chain *basechain,
err = nft_block_offload_cmd(basechain, dev, cmd);
else
err = nft_indr_block_offload_cmd(basechain, dev, cmd);
-
- if (err < 0)
- return err;
+
+ if (err < 0) {
+ if (this_dev)
+ return err;
+ else if (cmd == FLOW_BLOCK_BIND)
+ goto err_unbind;
+ }
+ i++;
}
return 0;
+
+err_unbind:
+ list_for_each_entry(hook, &basechain->hook_list, list) {
+ if (i-- <= 0)
+ break;
+
+ dev = hook->ops.dev;
+ nft_flow_block_chain(basechain, dev, FLOW_BLOCK_UNBIND);
+ }
+
+ return err;
}
static int nft_flow_offload_chain(struct nft_chain *chain, u8 *ppolicy,
--
1.8.3.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH nf-next] netfilter: nf_tables_offload: Fix unbind devices when subsequent device bind failed
2019-10-24 3:55 [PATCH nf-next] netfilter: nf_tables_offload: Fix unbind devices when subsequent device bind failed wenxu
@ 2019-10-24 9:25 ` Pablo Neira Ayuso
0 siblings, 0 replies; 2+ messages in thread
From: Pablo Neira Ayuso @ 2019-10-24 9:25 UTC (permalink / raw)
To: wenxu; +Cc: fw, netfilter-devel
On Thu, Oct 24, 2019 at 11:55:22AM +0800, wenxu@ucloud.cn wrote:
> From: wenxu <wenxu@ucloud.cn>
>
> In the nft_flow_block_chain some devices bind success, but the subsequent
> device failed. It should unbind the successful devices.
Thank you for you patch, although I decided to follow a different path:
https://patchwork.ozlabs.org/patch/1182733/
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-10-24 9:25 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-24 3:55 [PATCH nf-next] netfilter: nf_tables_offload: Fix unbind devices when subsequent device bind failed wenxu
2019-10-24 9:25 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).