Netfilter fixes for 4.19 -stable

Netfilter fixes for 4.19 -stable

[Pablo Neira Ayuso]

Hi Sasha,

Via Laura Garcia.

Could you cherry-pick the following netfilter fixes for 4.19 -stable?

https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nft_compat.c?id=12c44aba6618b7f6c437076e5722237190f6cd5f
commit    12c44aba6618b7f6c437076e5722237190f6cd5f
netfilter: nft_compat: use refcnt_t type for nft_xt reference count

https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nft_compat.c?id=cf52572ebbd7189a1966c2b5fc34b97078cd1dce
commit    cf52572ebbd7189a1966c2b5fc34b97078cd1dce
netfilter: nft_compat: make lists per netns

https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nft_compat.c?id=b2e3d68d1251a051a620f9086e18f7ffa6833b5b
commit    b2e3d68d1251a051a620f9086e18f7ffa6833b5b
netfilter: nft_compat: destroy function must not have side effects

https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nf_tables_api.c?id=cd5125d8f51882279f50506bb9c7e5e89dc9bef3
commit    cd5125d8f51882279f50506bb9c7e5e89dc9bef3
netfilter: nf_tables: split set destruction in deactivate and destroy phase

https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nft_compat.c?id=f6ac8585897684374a19863fff21186a05805286
commit    f6ac8585897684374a19863fff21186a05805286
netfilter: nf_tables: unbind set in rule from commit path

https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nft_compat.c?id=947e492c0fc2132ae5fca081a9c2952ccaab0404
commit    947e492c0fc2132ae5fca081a9c2952ccaab0404
netfilter: nft_compat: don't use refcount_inc on newly allocated entry

https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nf_tables_api.c?id=b8e204006340b7aaf32bd2b9806c692f6e0cb38a
commit    b8e204006340b7aaf32bd2b9806c692f6e0cb38a
netfilter: nft_compat: use .release_ops and remove list of extension

https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nf_tables_api.c?id=40ba1d9b4d19796afc9b7ece872f5f3e8f5e2c13
commit    40ba1d9b4d19796afc9b7ece872f5f3e8f5e2c13
netfilter: nf_tables: fix set double-free in abort path

https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nf_tables_api.c?id=273fe3f1006ea5ebc63d6729e43e8e45e32b256a
commit    273fe3f1006ea5ebc63d6729e43e8e45e32b256a
netfilter: nf_tables: bogus EBUSY when deleting set after flush

https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nft_objref.c?id=8ffcd32f64633926163cdd07a7d295c500a947d1
commit    8ffcd32f64633926163cdd07a7d295c500a947d1
netfilter: nf_tables: bogus EBUSY in helper removal from transaction

Thanks.

Re: Netfilter fixes for 4.19 -stable

[Sasha Levin]

On Fri, Apr 26, 2019 at 08:32:19PM +0200, Pablo Neira Ayuso wrote:
>Hi Sasha,
>
>Via Laura Garcia.
>
>Could you cherry-pick the following netfilter fixes for 4.19 -stable?
>
>https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nft_compat.c?id=12c44aba6618b7f6c437076e5722237190f6cd5f
>commit    12c44aba6618b7f6c437076e5722237190f6cd5f
>netfilter: nft_compat: use refcnt_t type for nft_xt reference count
>
>https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nft_compat.c?id=cf52572ebbd7189a1966c2b5fc34b97078cd1dce
>commit    cf52572ebbd7189a1966c2b5fc34b97078cd1dce
>netfilter: nft_compat: make lists per netns
>
>https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nft_compat.c?id=b2e3d68d1251a051a620f9086e18f7ffa6833b5b
>commit    b2e3d68d1251a051a620f9086e18f7ffa6833b5b
>netfilter: nft_compat: destroy function must not have side effects
>
>https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nf_tables_api.c?id=cd5125d8f51882279f50506bb9c7e5e89dc9bef3
>commit    cd5125d8f51882279f50506bb9c7e5e89dc9bef3
>netfilter: nf_tables: split set destruction in deactivate and destroy phase
>
>https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nft_compat.c?id=f6ac8585897684374a19863fff21186a05805286
>commit    f6ac8585897684374a19863fff21186a05805286
>netfilter: nf_tables: unbind set in rule from commit path
>
>https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nft_compat.c?id=947e492c0fc2132ae5fca081a9c2952ccaab0404
>commit    947e492c0fc2132ae5fca081a9c2952ccaab0404
>netfilter: nft_compat: don't use refcount_inc on newly allocated entry
>
>https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nf_tables_api.c?id=b8e204006340b7aaf32bd2b9806c692f6e0cb38a
>commit    b8e204006340b7aaf32bd2b9806c692f6e0cb38a
>netfilter: nft_compat: use .release_ops and remove list of extension
>
>https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nf_tables_api.c?id=40ba1d9b4d19796afc9b7ece872f5f3e8f5e2c13
>commit    40ba1d9b4d19796afc9b7ece872f5f3e8f5e2c13
>netfilter: nf_tables: fix set double-free in abort path
>
>https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nf_tables_api.c?id=273fe3f1006ea5ebc63d6729e43e8e45e32b256a
>commit    273fe3f1006ea5ebc63d6729e43e8e45e32b256a
>netfilter: nf_tables: bogus EBUSY when deleting set after flush
>
>https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/net/netfilter/nft_objref.c?id=8ffcd32f64633926163cdd07a7d295c500a947d1
>commit    8ffcd32f64633926163cdd07a7d295c500a947d1
>netfilter: nf_tables: bogus EBUSY in helper removal from transaction

I've had to play a bit with the ordering, but queued them all up,
thanks!

--
Thanks,
Sasha