MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-07-07 18:05:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

netfilter: nf_tables: Introduce nf_tables_getobj_single

Browse Source 
[ Upstream commit 69fc3e9e90 ]

Outsource the reply skb preparation for non-dump getrule requests into a
distinct function. Prep work for object reset locking.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Stable-dep-of: bd662c4218 ("netfilter: nf_tables: Add locking for NFT_MSG_GETOBJ_RESET requests")
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Phil Sutter 2024-08-09 15:07:31 +02:00 committed by Greg Kroah-Hartman
parent cf4ebf7797
commit 4340de3e65
1 changed files with 49 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

85
net/netfilter/nf_tables_api.c
View File

@ -7815,10 +7815,10 @@ static int nf_tables_dump_obj_done(struct netlink_callback *cb)
} }
/* called with rcu_read_lock held */ /* called with rcu_read_lock held */
static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info, static struct sk_buff *
const struct nlattr * const nla[]) nf_tables_getobj_single(u32 portid, const struct nfnl_info *info,
const struct nlattr * const nla[], bool reset)
{ {
const struct nftables_pernet *nft_net = nft_pernet(info->net);
struct netlink_ext_ack *extack = info->extack; struct netlink_ext_ack *extack = info->extack;
u8 genmask = nft_genmask_cur(info->net); u8 genmask = nft_genmask_cur(info->net);
u8 family = info->nfmsg->nfgen_family; u8 family = info->nfmsg->nfgen_family;
@ -7826,11 +7826,51 @@ static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info,
struct net *net = info->net; struct net *net = info->net;
struct nft_object *obj; struct nft_object *obj;
struct sk_buff *skb2; struct sk_buff *skb2;
bool reset = false;
u32 objtype; u32 objtype;
char *buf;
int err; int err;
if (!nla[NFTA_OBJ_NAME] ||
!nla[NFTA_OBJ_TYPE])
return ERR_PTR(-EINVAL);
table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 0);
if (IS_ERR(table)) {
NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
return ERR_CAST(table);
}
objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
if (IS_ERR(obj)) {
NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
return ERR_CAST(obj);
}
skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
if (!skb2)
return ERR_PTR(-ENOMEM);
err = nf_tables_fill_obj_info(skb2, net, portid,
info->nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0,
family, table, obj, reset);
if (err < 0) {
kfree_skb(skb2);
return ERR_PTR(err);
}
return skb2;
}
static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info,
const struct nlattr * const nla[])
{
struct nftables_pernet *nft_net = nft_pernet(info->net);
u32 portid = NETLINK_CB(skb).portid;
struct net *net = info->net;
struct sk_buff *skb2;
bool reset = false;
char *buf;
if (info->nlh->nlmsg_flags & NLM_F_DUMP) { if (info->nlh->nlmsg_flags & NLM_F_DUMP) {
struct netlink_dump_control c = { struct netlink_dump_control c = {
.start = nf_tables_dump_obj_start, .start = nf_tables_dump_obj_start,
@ -7843,35 +7883,12 @@ static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info,
return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c); return nft_netlink_dump_start_rcu(info->sk, skb, info->nlh, &c);
} }
if (!nla[NFTA_OBJ_NAME] ||
!nla[NFTA_OBJ_TYPE])
return -EINVAL;
table = nft_table_lookup(net, nla[NFTA_OBJ_TABLE], family, genmask, 0);
if (IS_ERR(table)) {
NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_TABLE]);
return PTR_ERR(table);
}
objtype = ntohl(nla_get_be32(nla[NFTA_OBJ_TYPE]));
obj = nft_obj_lookup(net, table, nla[NFTA_OBJ_NAME], objtype, genmask);
if (IS_ERR(obj)) {
NL_SET_BAD_ATTR(extack, nla[NFTA_OBJ_NAME]);
return PTR_ERR(obj);
}
skb2 = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
if (!skb2)
return -ENOMEM;
if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET) if (NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_GETOBJ_RESET)
reset = true; reset = true;
err = nf_tables_fill_obj_info(skb2, net, NETLINK_CB(skb).portid, skb2 = nf_tables_getobj_single(portid, info, nla, reset);
info->nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0, if (IS_ERR(skb2))
family, table, obj, reset); return PTR_ERR(skb2);
if (err < 0)
goto err_fill_obj_info;
if (!reset) if (!reset)
return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid);
@ -7884,11 +7901,7 @@ static int nf_tables_getobj(struct sk_buff *skb, const struct nfnl_info *info,
AUDIT_NFT_OP_OBJ_RESET, GFP_ATOMIC); AUDIT_NFT_OP_OBJ_RESET, GFP_ATOMIC);
kfree(buf); kfree(buf);
return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); return nfnetlink_unicast(skb2, net, portid);
err_fill_obj_info:
kfree_skb(skb2);
return err;
} }
static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj) static void nft_obj_destroy(const struct nft_ctx *ctx, struct nft_object *obj)