netfilter: nf_tables: Add locking for NFT_MSG_GETSETELEM_RESET requests

Browse source

Set expressions' dump callbacks are not concurrency-safe per-se with
reset bit set. If two CPUs reset the same element at the same time,
values may underrun at least with element-attached counters and quotas.

Prevent this by introducing dedicated callbacks for nfnetlink and the
asynchronous dump handling to serialize access.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Phil Sutter 2023-11-09 16:01:16 +01:00 • committed by Pablo Neira Ayuso

parent f649be6d9c

commit 3d483faa66

1 changed files with 81 additions and 17 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

98

net/netfilter/nf_tables_api.c

View file