netfilter: nf_tables: report use refcount overflow

Browse source

Overflow use refcount checks are not complete.

Add helper function to deal with object reference counter tracking.
Report -EMFILE in case UINT_MAX is reached.

nft_use_dec() splats in case that reference counter underflows,
which should not ever happen.

Add nft_use_inc_restore() and nft_use_dec_restore() which are used
to restore reference counter from error and abort paths.

Use u32 in nft_flowtable and nft_object since helper functions cannot
work on bitfields.

Remove the few early incomplete checks now that the helper functions
are in place and used to check for refcount overflow.

Fixes: 96518518cc ("netfilter: add nftables")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Pablo Neira Ayuso 2023-06-28 16:24:27 +02:00

parent c451410ca7

commit 1689f25924

5 changed files with 141 additions and 75 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

31

include/net/netfilter/nf_tables.h

View file

163

net/netfilter/nf_tables_api.c

View file

6

net/netfilter/nft_flow_offload.c

View file

8

net/netfilter/nft_immediate.c

View file

8

net/netfilter/nft_objref.c

View file