[RHEL7,COMMIT] ms/netfilter: ipset: pernet ops must be unregistered last

Submitted by Konstantin Khorenko on June 15, 2018, 4:06 p.m.

Details

Message ID 201806151606.w5FG6ZUE013859@finist_ce7.work
State New
Series "Series without cover letter"
Headers show

Commit Message

Konstantin Khorenko June 15, 2018, 4:06 p.m.
The commit is pushed to "branch-rh7-3.10.0-693.21.1.vz7.50.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-693.21.1.vz7.50.11
------>
commit a217d2b8b86d69af1a4d65db27230706dde24a31
Author: Florian Westphal <fw@strlen.de>
Date:   Fri Jun 15 19:06:35 2018 +0300

    ms/netfilter: ipset: pernet ops must be unregistered last
    
    Removing the ipset module leaves a small window where one cpu performs
    module removal while another runs a command like 'ipset flush'.
    
    ipset uses net_generic(), unregistering the pernet ops frees this
    storage area.
    
    Fix it by first removing the user-visible api handlers and the pernet
    ops last.
    
    Fixes: 1785e8f473082 ("netfiler: ipset: Add net namespace for ipset")
    Reported-by: Li Shuang <shuali@redhat.com>
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    
    https://pmc.acronis.com/browse/VSTOR-11137
    (cherry picked from commit e23ed762db7ed1950a6408c3be80bc56909ab3d4)
    Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
---
 net/netfilter/ipset/ip_set_core.c | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

Patch hide | download patch | download mbox

diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 02b8ff315e97..e019af57414e 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1901,24 +1901,28 @@  static struct pernet_operations ip_set_net_ops = {
 static int __init
 ip_set_init(void)
 {
-	int ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
+	int ret = register_pernet_subsys(&ip_set_net_ops);
+
+	if (ret) {
+		pr_err("ip_set: cannot register pernet_subsys.\n");
+		return ret;
+	}
+
+	ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
 	if (ret != 0) {
 		pr_err("ip_set: cannot register with nfnetlink.\n");
+		unregister_pernet_subsys(&ip_set_net_ops);
 		return ret;
 	}
+
 	ret = nf_register_sockopt(&so_set);
 	if (ret != 0) {
 		pr_err("SO_SET registry failed: %d\n", ret);
 		nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
+		unregister_pernet_subsys(&ip_set_net_ops);
 		return ret;
 	}
-	ret = register_pernet_subsys(&ip_set_net_ops);
-	if (ret) {
-		pr_err("ip_set: cannot register pernet_subsys.\n");
-		nf_unregister_sockopt(&so_set);
-		nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
-		return ret;
-	}
+
 	pr_info("ip_set: protocol %u\n", IPSET_PROTOCOL);
 	return 0;
 }
@@ -1926,9 +1930,10 @@  ip_set_init(void)
 static void __exit
 ip_set_fini(void)
 {
-	unregister_pernet_subsys(&ip_set_net_ops);
 	nf_unregister_sockopt(&so_set);
 	nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
+
+	unregister_pernet_subsys(&ip_set_net_ops);
 	pr_debug("these are the famous last words\n");
 }