@@ -46,6 +46,7 @@ struct hashlimit_net {
struct hlist_head htables;
struct proc_dir_entry *ipt_hashlimit;
struct proc_dir_entry *ip6t_hashlimit;
+ int clean;
};
static int hashlimit_net_id;
@@ -319,7 +320,8 @@ static void htable_destroy(struct
xt_hashlimit_htable *hinfo)
parent = hashlimit_net->ipt_hashlimit;
else
parent = hashlimit_net->ip6t_hashlimit;
- remove_proc_entry(hinfo->pde->name, parent);
+ if(!hashlimit_net->clean)
+ remove_proc_entry(hinfo->pde->name, parent);
htable_selective_cleanup(hinfo, select_all);
vfree(hinfo);
The following patch fixes a bug in xt_hashlimit. Bug appears at the end of work the networks namespace, provided that the tables (filter/mangle/raw) have rule with xt_hashlimit. The error occurs because the __net_exit hashlimit_net_exit() is executed before the tables are cleared. Change this order of calls is impossible, since tables must be registered earlier than extensions. Bug exists in all versions of the kernel since 2.6.35 Cleaning tables before completing the network namespace can be used as a workaround. Idea of the patch that if the files are deleted from the directory /proc/net/ip[6]t_hashlimit/" procedure XXXXX, then a flag is set "clean". If cleaning the tables occurs later and the flag "clean" is set, then the delete files is skipped. Patch for kernel 3.4.22 Signed-off-by: Vitaly Lavrov lve@guap.ru --- } @@ -784,6 +786,7 @@ static int __net_init hashlimit_net_init(struct net *net) { struct hashlimit_net *hashlimit_net = hashlimit_pernet(net); + hashlimit_net->clean = 0; INIT_HLIST_HEAD(&hashlimit_net->htables); return hashlimit_proc_net_init(net); } @@ -791,8 +794,19 @@ static int __net_init hashlimit_net_init(struct net *net) static void __net_exit hashlimit_net_exit(struct net *net) { struct hashlimit_net *hashlimit_net = hashlimit_pernet(net); + struct xt_hashlimit_htable *hinfo; + struct hlist_node *pos; + struct proc_dir_entry *pde; + + mutex_lock(&hashlimit_mutex); + hashlimit_net->clean = 1; + pde = hashlimit_net->ipt_hashlimit; + if(!pde) pde = hashlimit_net->ip6t_hashlimit; + hlist_for_each_entry(hinfo, pos, &hashlimit_net->htables, node) { + remove_proc_entry(hinfo->pde->name,pde); + } + mutex_unlock(&hashlimit_mutex); - BUG_ON(!hlist_empty(&hashlimit_net->htables)); hashlimit_proc_net_exit(net); } -- diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c index 2195eb0..5416185 100644 --- a/net/netfilter/xt_hashlimit.c +++ b/net/netfilter/xt_hashlimit.c @@ -46,6 +46,7 @@ struct hashlimit_net { struct hlist_head htables; struct proc_dir_entry *ipt_hashlimit; struct proc_dir_entry *ip6t_hashlimit; + int clean; }; static int hashlimit_net_id; @@ -319,7 +320,8 @@ static void htable_destroy(struct xt_hashlimit_htable *hinfo) parent = hashlimit_net->ipt_hashlimit; else parent = hashlimit_net->ip6t_hashlimit; - remove_proc_entry(hinfo->pde->name, parent); + if(!hashlimit_net->clean) + remove_proc_entry(hinfo->pde->name, parent); htable_selective_cleanup(hinfo, select_all); vfree(hinfo); } @@ -784,6 +786,7 @@ static int __net_init hashlimit_net_init(struct net *net) { struct hashlimit_net *hashlimit_net = hashlimit_pernet(net); + hashlimit_net->clean = 0; INIT_HLIST_HEAD(&hashlimit_net->htables); return hashlimit_proc_net_init(net); } @@ -791,8 +794,19 @@ static int __net_init hashlimit_net_init(struct net *net) static void __net_exit hashlimit_net_exit(struct net *net) { struct hashlimit_net *hashlimit_net = hashlimit_pernet(net); + struct xt_hashlimit_htable *hinfo; + struct hlist_node *pos; + struct proc_dir_entry *pde; + + mutex_lock(&hashlimit_mutex); + hashlimit_net->clean = 1; + pde = hashlimit_net->ipt_hashlimit; + if(!pde) pde = hashlimit_net->ip6t_hashlimit; + hlist_for_each_entry(hinfo, pos, &hashlimit_net->htables, node) { + remove_proc_entry(hinfo->pde->name,pde); + } + mutex_unlock(&hashlimit_mutex); - BUG_ON(!hlist_empty(&hashlimit_net->htables)); hashlimit_proc_net_exit(net); }