netfilter: unlock xt_table earlier in __do_replace

Browse source

Now it's doing cleanup_entry for oldinfo under the xt_table lock,
but it's not really necessary. After the replacement job is done
in xt_replace_table, oldinfo is not used elsewhere any more, and
it can be freed without xt_table lock safely.

The important thing is that rtnl_lock is called in some xt_target
destroy, which means rtnl_lock, a big lock is used in xt_table
lock, a smaller one. It usually could be the reason why a dead
lock may happen.

Besides, all xt_target/match checkentry is called out of xt_table
lock. It's better also to move all cleanup_entry calling out of
xt_table lock, just as do_replace_finish does for ebtables.

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

...

This commit is contained in:

Xin Long 2018-02-16 18:04:56 +08:00 • committed by Pablo Neira Ayuso

parent 2db3fec507

commit f31e5f1a89

3 changed files with 6 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

net/ipv4/netfilter/arp_tables.c

View file

3

net/ipv4/netfilter/ip_tables.c

View file

3

net/ipv6/netfilter/ip6_tables.c

View file