From patchwork Thu Aug 8 17:54:30 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pablo Neira Ayuso X-Patchwork-Id: 265794 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id BAAE92C00A1 for ; Fri, 9 Aug 2013 03:54:52 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965858Ab3HHRyt (ORCPT ); Thu, 8 Aug 2013 13:54:49 -0400 Received: from mail.us.es ([193.147.175.20]:35285 "EHLO mail.us.es" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965829Ab3HHRyt (ORCPT ); Thu, 8 Aug 2013 13:54:49 -0400 Received: (qmail 5938 invoked from network); 8 Aug 2013 19:54:46 +0200 Received: from unknown (HELO us.es) (192.168.2.11) by us.es with SMTP; 8 Aug 2013 19:54:46 +0200 Received: (qmail 1309 invoked by uid 507); 8 Aug 2013 17:54:45 -0000 X-Qmail-Scanner-Diagnostics: from 127.0.0.1 by antivirus1 (envelope-from , uid 501) with qmail-scanner-2.10 (clamdscan: 0.97.8/17646. spamassassin: 3.3.2. Clear:RC:1(127.0.0.1):SA:0(-98.2/7.5):. Processed in 2.313508 secs); 08 Aug 2013 17:54:45 -0000 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on antivirus1 X-Spam-Level: X-Spam-Status: No, score=-98.2 required=7.5 tests=BAYES_50,RCVD_IN_PBL, RDNS_NONE,USER_IN_WHITELIST autolearn=disabled version=3.3.2 X-Envelope-From: pablo@netfilter.org Received: from unknown (HELO antivirus1) (127.0.0.1) by us.es with SMTP; 8 Aug 2013 17:54:43 -0000 Received: from 192.168.1.13 (192.168.1.13) by antivirus1 (F-Secure/fsigk_smtp/410/antivirus1); Thu, 08 Aug 2013 19:54:43 +0200 (CEST) X-Virus-Status: clean(F-Secure/fsigk_smtp/410/antivirus1) Received: (qmail 10779 invoked from network); 8 Aug 2013 19:54:41 +0200 Received: from unknown (HELO localhost.localdomain) (pneira@us.es@77.208.159.33) by us.es with SMTP; 8 Aug 2013 19:54:41 +0200 From: Pablo Neira Ayuso To: netfilter-devel@vger.kernel.org Subject: [PATCH nftables 1/2] netfilter: nf_tables: don't delete table if in use Date: Thu, 8 Aug 2013 19:54:30 +0200 Message-Id: <1375984471-21035-1-git-send-email-pablo@netfilter.org> X-Mailer: git-send-email 1.7.10.4 Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Return EBUSY if you try to delete a table that is in use. Signed-off-by: Pablo Neira Ayuso --- include/net/netfilter/nf_tables.h | 4 +++- net/netfilter/nf_tables_api.c | 8 ++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index 805490d..215edf5 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -440,8 +440,9 @@ extern unsigned int nft_do_chain_pktinfo(struct nft_pktinfo *pkt, * @list: used internally * @chains: chains in the table * @sets: sets in the table - * @flags: table flag (see enum nft_table_flags) * @hgenerator: handle generator state + * @use: number of chain references to this table + * @flags: table flag (see enum nft_table_flags) * @name: name of the table */ struct nft_table { @@ -449,6 +450,7 @@ struct nft_table { struct list_head chains; struct list_head sets; u64 hgenerator; + u32 use; u16 flags; char name[]; }; diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 2b7bf88..c93ce18 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -448,6 +448,9 @@ static int nf_tables_deltable(struct sock *nlsk, struct sk_buff *skb, if (IS_ERR(table)) return PTR_ERR(table); + if (table->use) + return -EBUSY; + list_del(&table->list); nf_tables_table_notify(skb, nlh, table, NFT_MSG_DELTABLE, family); kfree(table); @@ -832,6 +835,9 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb, if (IS_ERR(table)) return PTR_ERR(table); + if (table->use == UINT_MAX) + return -EOVERFLOW; + chain = NULL; name = nla[NFTA_CHAIN_NAME]; @@ -986,6 +992,7 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb, } } list_add_tail(&chain->list, &table->chains); + table->use++; notify: nf_tables_chain_notify(skb, nlh, table, chain, NFT_MSG_NEWCHAIN, family); @@ -1031,6 +1038,7 @@ static int nf_tables_delchain(struct sock *nlsk, struct sk_buff *skb, return -EBUSY; list_del(&chain->list); + table->use--; if (!(table->flags & NFT_TABLE_F_DORMANT) && chain->flags & NFT_BASE_CHAIN)