diff mbox

[2/3] netfilter: hide reference to nf_hooks_ingress

Message ID 20160930160559.4102745-2-arnd@arndb.de
State Changes Requested
Delegated to: Pablo Neira
Headers show

Commit Message

Arnd Bergmann Sept. 30, 2016, 4:05 p.m. UTC
A recent cleanup added an unconditional reference to the nf_hooks_ingress pointer,
but that fails when CONFIG_NETFILTER_INGRESS is disabled and that member is
not present in net_device:

net/netfilter/core.c: In function 'nf_set_hooks_head':
net/netfilter/core.c:96:30: error: 'struct net_device' has no member named 'nf_hooks_ingress'

This avoids the build error by simply enclosing the assignment in an #ifdef,
which may or may not be the correct fix.

Fixes: e3b37f11e6e4 ("netfilter: replace list_head with single linked list")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
 net/netfilter/core.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Aaron Conole Sept. 30, 2016, 5:06 p.m. UTC | #1
Arnd Bergmann <arnd@arndb.de> writes:

> A recent cleanup added an unconditional reference to the nf_hooks_ingress pointer,
> but that fails when CONFIG_NETFILTER_INGRESS is disabled and that member is
> not present in net_device:
>
> net/netfilter/core.c: In function 'nf_set_hooks_head':
> net/netfilter/core.c:96:30: error: 'struct net_device' has no member named 'nf_hooks_ingress'
>
> This avoids the build error by simply enclosing the assignment in an #ifdef,
> which may or may not be the correct fix.

NAK, it's not the right fix.  The entry being set may be leaked with only this
hunk.  I've posted a complete fix for this.

Sorry that it was broken.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 576a9c0406a9..5ccff1d9f209 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -90,10 +90,12 @@  static void nf_set_hooks_head(struct net *net, const struct nf_hook_ops *reg,
 {
 	switch (reg->pf) {
 	case NFPROTO_NETDEV:
+#ifdef CONFIG_NETFILTER_INGRESS
 		/* We already checked in nf_register_net_hook() that this is
 		 * used from ingress.
 		 */
 		rcu_assign_pointer(reg->dev->nf_hooks_ingress, entry);
+#endif
 		break;
 	default:
 		rcu_assign_pointer(net->nf.hooks[reg->pf][reg->hooknum],