netfilter: nf_tables: Add locking for NFT_MSG_GETRULE_RESET requests

Browse source

Rule reset is not concurrency-safe per-se, so multiple CPUs may reset
the same rule at the same time. At least counter and quota expressions
will suffer from value underruns in this case.

Prevent this by introducing dedicated locking callbacks for nfnetlink
and the asynchronous dump handling to serialize access.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Phil Sutter 2023-10-19 16:03:36 +02:00 • committed by Pablo Neira Ayuso

parent 1578c32877

commit 3cb03edb4d

1 changed files with 64 additions and 13 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

77

net/netfilter/nf_tables_api.c

View file