github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-05 04:56:13 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

netfilter: x_tables: unregister the templates first

Browse Source 
When the module is going away we need to zap the template
first.  Else there is a small race window where userspace
could instantiate a new table after the pernet exit function
has removed the current table.

Fixes: fdacd57c79 ("netfilter: x_tables: never register tables by default")
Reported-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Tristan Madani <tristan@talencesecurity.com>
Closes: https://lore.kernel.org/netfilter-devel/20260429175613.1459342-1-tristmd@gmail.com/
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2026-05-06 12:07:16 +02:00 committed by Pablo Neira Ayuso
parent 527d693147
commit d338693d77
9 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/ipv4/netfilter/arptable_filter.c
View File

@ -82,8 +82,8 @@ static int __init arptable_filter_init(void)
static void __exit arptable_filter_fini(void)
{
unregister_pernet_subsys(&arptable_filter_net_ops);
xt_unregister_template(&packet_filter);
unregister_pernet_subsys(&arptable_filter_net_ops);
kfree(arpfilter_ops);
}

2
net/ipv4/netfilter/iptable_filter.c
View File

@ -101,8 +101,8 @@ static int __init iptable_filter_init(void)
static void __exit iptable_filter_fini(void)
{
unregister_pernet_subsys(&iptable_filter_net_ops);
xt_unregister_template(&packet_filter);
unregister_pernet_subsys(&iptable_filter_net_ops);
kfree(filter_ops);
}

2
net/ipv4/netfilter/iptable_mangle.c
View File

@ -135,8 +135,8 @@ static int __init iptable_mangle_init(void)
static void __exit iptable_mangle_fini(void)
{
unregister_pernet_subsys(&iptable_mangle_net_ops);
xt_unregister_template(&packet_mangler);
unregister_pernet_subsys(&iptable_mangle_net_ops);
kfree(mangle_ops);
}

2
net/ipv4/netfilter/iptable_raw.c
View File

@ -100,9 +100,9 @@ static int __init iptable_raw_init(void)
static void __exit iptable_raw_fini(void)
{
xt_unregister_template(&packet_raw);
unregister_pernet_subsys(&iptable_raw_net_ops);
kfree(rawtable_ops);
xt_unregister_template(&packet_raw);
}
module_init(iptable_raw_init);

2
net/ipv4/netfilter/iptable_security.c
View File

@ -89,9 +89,9 @@ static int __init iptable_security_init(void)
static void __exit iptable_security_fini(void)
{
xt_unregister_template(&security_table);
unregister_pernet_subsys(&iptable_security_net_ops);
kfree(sectbl_ops);
xt_unregister_template(&security_table);
}
module_init(iptable_security_init);

2
net/ipv6/netfilter/ip6table_filter.c
View File

@ -100,8 +100,8 @@ static int __init ip6table_filter_init(void)
static void __exit ip6table_filter_fini(void)
{
unregister_pernet_subsys(&ip6table_filter_net_ops);
xt_unregister_template(&packet_filter);
unregister_pernet_subsys(&ip6table_filter_net_ops);
kfree(filter_ops);
}

2
net/ipv6/netfilter/ip6table_mangle.c
View File

@ -128,8 +128,8 @@ static int __init ip6table_mangle_init(void)
static void __exit ip6table_mangle_fini(void)
{
unregister_pernet_subsys(&ip6table_mangle_net_ops);
xt_unregister_template(&packet_mangler);
unregister_pernet_subsys(&ip6table_mangle_net_ops);
kfree(mangle_ops);
}

2
net/ipv6/netfilter/ip6table_raw.c
View File

@ -98,8 +98,8 @@ static int __init ip6table_raw_init(void)
static void __exit ip6table_raw_fini(void)
{
unregister_pernet_subsys(&ip6table_raw_net_ops);
xt_unregister_template(&packet_raw);
unregister_pernet_subsys(&ip6table_raw_net_ops);
kfree(rawtable_ops);
}

2
net/ipv6/netfilter/ip6table_security.c
View File

@ -88,8 +88,8 @@ static int __init ip6table_security_init(void)
static void __exit ip6table_security_fini(void)
{
unregister_pernet_subsys(&ip6table_security_net_ops);
xt_unregister_template(&security_table);
unregister_pernet_subsys(&ip6table_security_net_ops);
kfree(sectbl_ops);
}