@@ -440,8 +440,9 @@ extern unsigned int nft_do_chain_pktinfo(struct nft_pktinfo *pkt,
* @list: used internally
* @chains: chains in the table
* @sets: sets in the table
- * @flags: table flag (see enum nft_table_flags)
* @hgenerator: handle generator state
+ * @use: number of chain references to this table
+ * @flags: table flag (see enum nft_table_flags)
* @name: name of the table
*/
struct nft_table {
@@ -449,6 +450,7 @@ struct nft_table {
struct list_head chains;
struct list_head sets;
u64 hgenerator;
+ u32 use;
u16 flags;
char name[];
};
@@ -448,6 +448,9 @@ static int nf_tables_deltable(struct sock *nlsk, struct sk_buff *skb,
if (IS_ERR(table))
return PTR_ERR(table);
+ if (table->use)
+ return -EBUSY;
+
list_del(&table->list);
nf_tables_table_notify(skb, nlh, table, NFT_MSG_DELTABLE, family);
kfree(table);
@@ -832,6 +835,9 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
if (IS_ERR(table))
return PTR_ERR(table);
+ if (table->use == UINT_MAX)
+ return -EOVERFLOW;
+
chain = NULL;
name = nla[NFTA_CHAIN_NAME];
@@ -986,6 +992,7 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
}
}
list_add_tail(&chain->list, &table->chains);
+ table->use++;
notify:
nf_tables_chain_notify(skb, nlh, table, chain, NFT_MSG_NEWCHAIN,
family);
@@ -1031,6 +1038,7 @@ static int nf_tables_delchain(struct sock *nlsk, struct sk_buff *skb,
return -EBUSY;
list_del(&chain->list);
+ table->use--;
if (!(table->flags & NFT_TABLE_F_DORMANT) &&
chain->flags & NFT_BASE_CHAIN)
Return EBUSY if you try to delete a table that is in use. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- include/net/netfilter/nf_tables.h | 4 +++- net/netfilter/nf_tables_api.c | 8 ++++++++ 2 files changed, 11 insertions(+), 1 deletion(-)