diff mbox series

[net-next,07/11] net/sched: act_ct: set net pointer before publishing flowtable

Message ID 20260927223436.269024-8-pablo@netfilter.org
State Accepted
Headers show
Series [net-next,01/11] netfilter: synproxy: fix reset of ct seqadj when reopening a connection | expand

Commit Message

Pablo Neira Ayuso Sept. 27, 2026, 10:34 p.m. UTC 
From: Qingfang Deng <qingfang.deng@linux.dev>

nf_flow_table_init() adds the flowtable to the global flowtables list.
However, tcf_ct_flow_table_get() sets the table's network namespace only
after that call, leaving a window where the published table has a NULL
namespace pointer.

Set the namespace before calling nf_flow_table_init() so that flowtable
list walkers can rely on it being initialized.

This is required by:
"netfilter: flowtable: check namespace before iterating flows"

Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
Reviewed-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/sched/act_ct.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
index 411e3dd92d07..e26c0d5b2176 100644
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -349,10 +349,10 @@  static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)
 	ct_ft->nf_ft.type = &flowtable_ct;
 	ct_ft->nf_ft.flags |= NF_FLOWTABLE_HW_OFFLOAD |
 			      NF_FLOWTABLE_COUNTER;
+	write_pnet(&ct_ft->nf_ft.net, net);
 	err = nf_flow_table_init(&ct_ft->nf_ft);
 	if (err)
 		goto err_init;
-	write_pnet(&ct_ft->nf_ft.net, net);
 
 	__module_get(THIS_MODULE);
 out_unlock: