[PATCH net 7/7] netfilter: hold reference on module during netlink dump
flat view
COLD40d
SUPERSEDED
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: 2026-09-09 22:19:06
Also in:
netfilter-devel
Subsystem:
netfilter, networking [general], the rest · Maintainers:
Pablo Neira Ayuso, Florian Westphal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
Revision v1 of 40 in this series.
Revisions (40)
Modules can be removed in the middle of a netlink dump. Set .module to
THIS_MODULE in struct netlink_dump_control to hold a reference on the
module while netlink dump is in progress.
See commit 6dc878a8ca39 ("netlink: add reference of module in
netlink_dump_start") which describes this problem.
Fixes: a7b4f989a629 ("netfilter: ipset: IP set core support")
Fixes: c1d10adb4a52 ("[NETFILTER]: Add ctnetlink port for nf_conntrack")
Fixes: 50978462300f ("netfilter: add cttimeout infrastructure for fine timeout tuning")
Fixes: 9413902796f5 ("netfilter: add extended accounting infrastructure over nfnetlink")
Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/ipset/ip_set_core.c | 1 +
net/netfilter/nf_conntrack_netlink.c | 7 +++++++
net/netfilter/nfnetlink_acct.c | 1 +
net/netfilter/nfnetlink_cthelper.c | 1 +
net/netfilter/nfnetlink_cttimeout.c | 1 +
5 files changed, 11 insertions(+)
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 0a86a170ba90..624c5f14acf6 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c@@ -1733,6 +1733,7 @@ static int ip_set_dump(struct sk_buff *skb, const struct nfnl_info *info, .start = ip_set_dump_start, .dump = ip_set_dump_do, .done = ip_set_dump_done, + .module = THIS_MODULE, }; return netlink_dump_start(info->sk, skb, info->nlh, &c); }
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 579ada063b1b..2340885b2076 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c@@ -1682,6 +1682,7 @@ static int ctnetlink_get_conntrack(struct sk_buff *skb, .start = ctnetlink_start, .dump = ctnetlink_dump_table, .done = ctnetlink_done, + .module = THIS_MODULE, .data = (void *)cda, };
@@ -1826,6 +1827,7 @@ static int ctnetlink_get_ct_dying(struct sk_buff *skb, if (info->nlh->nlmsg_flags & NLM_F_DUMP) { struct netlink_dump_control c = { .dump = ctnetlink_dump_dying, + .module = THIS_MODULE, }; return netlink_dump_start(info->sk, skb, info->nlh, &c); }
@@ -1840,6 +1842,7 @@ static int ctnetlink_get_ct_unconfirmed(struct sk_buff *skb, if (info->nlh->nlmsg_flags & NLM_F_DUMP) { struct netlink_dump_control c = { .dump = ctnetlink_dump_unconfirmed, + .module = THIS_MODULE, }; return netlink_dump_start(info->sk, skb, info->nlh, &c); }
@@ -2555,6 +2558,7 @@ static int ctnetlink_stat_ct_cpu(struct sk_buff *skb, if (info->nlh->nlmsg_flags & NLM_F_DUMP) { struct netlink_dump_control c = { .dump = ctnetlink_ct_stat_cpu_dump, + .module = THIS_MODULE, }; return netlink_dump_start(info->sk, skb, info->nlh, &c); }
@@ -3278,6 +3282,7 @@ static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl, .dump = ctnetlink_exp_ct_dump_table, .start = ctnetlink_dump_exp_ct_start, .done = ctnetlink_dump_exp_ct_done, + .module = THIS_MODULE, }; err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER,
@@ -3327,6 +3332,7 @@ static int ctnetlink_get_expect(struct sk_buff *skb, else { struct netlink_dump_control c = { .dump = ctnetlink_exp_dump_table, + .module = THIS_MODULE, }; return netlink_dump_start(info->sk, skb, info->nlh, &c); }
@@ -3748,6 +3754,7 @@ static int ctnetlink_stat_exp_cpu(struct sk_buff *skb, if (info->nlh->nlmsg_flags & NLM_F_DUMP) { struct netlink_dump_control c = { .dump = ctnetlink_exp_stat_cpu_dump, + .module = THIS_MODULE, }; return netlink_dump_start(info->sk, skb, info->nlh, &c); }
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index 8ff1e0ad5cb0..39a62bb9a6e6 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c@@ -284,6 +284,7 @@ static int nfnl_acct_get(struct sk_buff *skb, const struct nfnl_info *info, .dump = nfnl_acct_dump, .start = nfnl_acct_start, .done = nfnl_acct_done, + .module = THIS_MODULE, .data = (void *)tb[NFACCT_FILTER], };
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index 5b6a09f46903..1331aba007ba 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c@@ -644,6 +644,7 @@ static int nfnl_cthelper_get(struct sk_buff *skb, const struct nfnl_info *info, if (info->nlh->nlmsg_flags & NLM_F_DUMP) { struct netlink_dump_control c = { .dump = nfnl_cthelper_dump_table, + .module = THIS_MODULE, }; return netlink_dump_start(info->sk, skb, info->nlh, &c); }
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index 132c02ac7c4e..29de875d1713 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c@@ -277,6 +277,7 @@ static int cttimeout_get_timeout(struct sk_buff *skb, if (info->nlh->nlmsg_flags & NLM_F_DUMP) { struct netlink_dump_control c = { .dump = ctnl_timeout_dump, + .module = THIS_MODULE, }; return netlink_dump_start(info->sk, skb, info->nlh, &c); }
--
2.47.3