Patchwork [2/3] netfilter: don't panic on error while walking through the init path

login
register
mail settings
Submitter Pablo Neira
Date May 23, 2013, 8:42 a.m.
Message ID <1369298557-5351-2-git-send-email-pablo@netfilter.org>
Download mbox | patch
Permalink /patch/245843/
State Accepted
Headers show

Comments

Pablo Neira - May 23, 2013, 8:42 a.m.
Don't panic if we hit an error while adding the nf_log or pernet
netfilter support, just bail out.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/core.c   |   19 ++++++++++++++-----
 net/netfilter/nf_log.c |    5 +----
 2 files changed, 15 insertions(+), 9 deletions(-)
Gao feng - May 23, 2013, 8:50 a.m.
On 05/23/2013 04:42 PM, Pablo Neira Ayuso wrote:
> Don't panic if we hit an error while adding the nf_log or pernet
> netfilter support, just bail out.
> 
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---

Acked-by: Gao feng <gaofeng@cn.fujitsu.com>

>  net/netfilter/core.c   |   19 ++++++++++++++-----
>  net/netfilter/nf_log.c |    5 +----
>  2 files changed, 15 insertions(+), 9 deletions(-)
> 
> diff --git a/net/netfilter/core.c b/net/netfilter/core.c
> index 07c865a..3905104 100644
> --- a/net/netfilter/core.c
> +++ b/net/netfilter/core.c
> @@ -304,15 +304,24 @@ static struct pernet_operations netfilter_net_ops = {
>  
>  void __init netfilter_init(void)
>  {
> -	int i, h;
> +	int i, h, ret;
> +
>  	for (i = 0; i < ARRAY_SIZE(nf_hooks); i++) {
>  		for (h = 0; h < NF_MAX_HOOKS; h++)
>  			INIT_LIST_HEAD(&nf_hooks[i][h]);
>  	}
>  
> -	if (register_pernet_subsys(&netfilter_net_ops) < 0)
> -		panic("cannot create netfilter proc entry");
> +	ret = register_pernet_subsys(&netfilter_net_ops);
> +	if (ret < 0)
> +		goto err;
> +
> +	ret = netfilter_log_init();
> +	if (ret < 0)
> +		goto err_pernet;
>  
> -	if (netfilter_log_init() < 0)
> -		panic("cannot initialize nf_log");
> +	return 0;
> +err_pernet:
> +	unregister_pernet_subsys(&netfilter_net_ops);
> +err:
> +	return ret;
>  }
> diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
> index 388656d..bd5474a 100644
> --- a/net/netfilter/nf_log.c
> +++ b/net/netfilter/nf_log.c
> @@ -368,10 +368,7 @@ static int __net_init nf_log_net_init(struct net *net)
>  	return 0;
>  
>  out_sysctl:
> -	/* For init_net: errors will trigger panic, don't unroll on error. */
> -	if (!net_eq(net, &init_net))
> -		remove_proc_entry("nf_log", net->nf.proc_netfilter);
> -
> +	remove_proc_entry("nf_log", net->nf.proc_netfilter);
>  	return ret;
>  }
>  
> 

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Pablo Neira - May 23, 2013, 11:09 a.m.
On Thu, May 23, 2013 at 04:50:48PM +0800, Gao feng wrote:
> On 05/23/2013 04:42 PM, Pablo Neira Ayuso wrote:
> > Don't panic if we hit an error while adding the nf_log or pernet
> > netfilter support, just bail out.
> > 
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> > ---
> 
> Acked-by: Gao feng <gaofeng@cn.fujitsu.com>

Applied.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 07c865a..3905104 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -304,15 +304,24 @@  static struct pernet_operations netfilter_net_ops = {
 
 void __init netfilter_init(void)
 {
-	int i, h;
+	int i, h, ret;
+
 	for (i = 0; i < ARRAY_SIZE(nf_hooks); i++) {
 		for (h = 0; h < NF_MAX_HOOKS; h++)
 			INIT_LIST_HEAD(&nf_hooks[i][h]);
 	}
 
-	if (register_pernet_subsys(&netfilter_net_ops) < 0)
-		panic("cannot create netfilter proc entry");
+	ret = register_pernet_subsys(&netfilter_net_ops);
+	if (ret < 0)
+		goto err;
+
+	ret = netfilter_log_init();
+	if (ret < 0)
+		goto err_pernet;
 
-	if (netfilter_log_init() < 0)
-		panic("cannot initialize nf_log");
+	return 0;
+err_pernet:
+	unregister_pernet_subsys(&netfilter_net_ops);
+err:
+	return ret;
 }
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 388656d..bd5474a 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -368,10 +368,7 @@  static int __net_init nf_log_net_init(struct net *net)
 	return 0;
 
 out_sysctl:
-	/* For init_net: errors will trigger panic, don't unroll on error. */
-	if (!net_eq(net, &init_net))
-		remove_proc_entry("nf_log", net->nf.proc_netfilter);
-
+	remove_proc_entry("nf_log", net->nf.proc_netfilter);
 	return ret;
 }