Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

[platform/kernel/linux-starfive.git] / net / netfilter / nf_tables_api.c

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 01dc0a1..ab93a35 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5287,6 +5287,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
        struct nft_expr *expr_array[NFT_SET_EXPR_MAX] = {};
        struct nlattr *nla[NFTA_SET_ELEM_MAX + 1];
        u8 genmask = nft_genmask_next(ctx->net);
+       u32 flags = 0, size = 0, num_exprs = 0;
        struct nft_set_ext_tmpl tmpl;
        struct nft_set_ext *ext, *ext2;
        struct nft_set_elem elem;
@@ -5296,7 +5297,6 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
        struct nft_data_desc desc;
        enum nft_registers dreg;
        struct nft_trans *trans;
-       u32 flags = 0, size = 0;
        u64 timeout;
        u64 expiration;
        int err, i;
@@ -5362,7 +5362,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
        if (nla[NFTA_SET_ELEM_EXPR]) {
                struct nft_expr *expr;
 
-               if (set->num_exprs != 1)
+               if (set->num_exprs && set->num_exprs != 1)
                        return -EOPNOTSUPP;
 
                expr = nft_set_elem_expr_alloc(ctx, set,
@@ -5371,8 +5371,9 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
                        return PTR_ERR(expr);
 
                expr_array[0] = expr;
+               num_exprs = 1;
 
-               if (set->exprs[0] && set->exprs[0]->ops != expr->ops) {
+               if (set->num_exprs && set->exprs[0]->ops != expr->ops) {
                        err = -EOPNOTSUPP;
                        goto err_set_elem_expr;
                }
@@ -5381,12 +5382,10 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
                struct nlattr *tmp;
                int left;
 
-               if (set->num_exprs == 0)
-                       return -EOPNOTSUPP;
-
                i = 0;
                nla_for_each_nested(tmp, nla[NFTA_SET_ELEM_EXPRESSIONS], left) {
-                       if (i == set->num_exprs) {
+                       if (i == NFT_SET_EXPR_MAX ||
+                           (set->num_exprs && set->num_exprs == i)) {
                                err = -E2BIG;
                                goto err_set_elem_expr;
                        }
@@ -5400,14 +5399,15 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
                                goto err_set_elem_expr;
                        }
                        expr_array[i] = expr;
+                       num_exprs++;
 
-                       if (expr->ops != set->exprs[i]->ops) {
+                       if (set->num_exprs && expr->ops != set->exprs[i]->ops) {
                                err = -EOPNOTSUPP;
                                goto err_set_elem_expr;
                        }
                        i++;
                }
-               if (set->num_exprs != i) {
+               if (set->num_exprs && set->num_exprs != i) {
                        err = -EOPNOTSUPP;
                        goto err_set_elem_expr;
                }
@@ -5415,6 +5415,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
                err = nft_set_elem_expr_clone(ctx, set, expr_array);
                if (err < 0)
                        goto err_set_elem_expr_clone;
+
+               num_exprs = set->num_exprs;
        }
 
        err = nft_setelem_parse_key(ctx, set, &elem.key.val,
@@ -5439,8 +5441,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
                        nft_set_ext_add(&tmpl, NFT_SET_EXT_TIMEOUT);
        }
 
-       if (set->num_exprs) {
-               for (i = 0; i < set->num_exprs; i++)
+       if (num_exprs) {
+               for (i = 0; i < num_exprs; i++)
                        size += expr_array[i]->ops->size;
 
                nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPRESSIONS,
@@ -5528,7 +5530,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
                *nft_set_ext_obj(ext) = obj;
                obj->use++;
        }
-       for (i = 0; i < set->num_exprs; i++)
+       for (i = 0; i < num_exprs; i++)
                nft_set_elem_expr_setup(ext, i, expr_array);
 
        trans = nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set);
@@ -5590,7 +5592,7 @@ err_parse_key_end:
 err_parse_key:
        nft_data_release(&elem.key.val, NFT_DATA_VALUE);
 err_set_elem_expr:
-       for (i = 0; i < set->num_exprs && expr_array[i]; i++)
+       for (i = 0; i < num_exprs && expr_array[i]; i++)
                nft_expr_destroy(ctx, expr_array[i]);
 err_set_elem_expr_clone:
        return err;
@@ -8986,6 +8988,17 @@ int __nft_release_basechain(struct nft_ctx *ctx)
 }
 EXPORT_SYMBOL_GPL(__nft_release_basechain);
 
+static void __nft_release_hooks(struct net *net)
+{
+       struct nft_table *table;
+       struct nft_chain *chain;
+
+       list_for_each_entry(table, &net->nft.tables, list) {
+               list_for_each_entry(chain, &table->chains, list)
+                       nf_tables_unregister_hook(net, table, chain);
+       }
+}
+
 static void __nft_release_tables(struct net *net)
 {
        struct nft_flowtable *flowtable, *nf;
@@ -9001,10 +9014,6 @@ static void __nft_release_tables(struct net *net)
 
        list_for_each_entry_safe(table, nt, &net->nft.tables, list) {
                ctx.family = table->family;
-
-               list_for_each_entry(chain, &table->chains, list)
-                       nf_tables_unregister_hook(net, table, chain);
-               /* No packets are walking on these chains anymore. */
                ctx.table = table;
                list_for_each_entry(chain, &table->chains, list) {
                        ctx.chain = chain;
@@ -9053,6 +9062,11 @@ static int __net_init nf_tables_init_net(struct net *net)
        return 0;
 }
 
+static void __net_exit nf_tables_pre_exit_net(struct net *net)
+{
+       __nft_release_hooks(net);
+}
+
 static void __net_exit nf_tables_exit_net(struct net *net)
 {
        mutex_lock(&net->nft.commit_mutex);
@@ -9066,8 +9080,9 @@ static void __net_exit nf_tables_exit_net(struct net *net)
 }
 
 static struct pernet_operations nf_tables_net_ops = {
-       .init   = nf_tables_init_net,
-       .exit   = nf_tables_exit_net,
+       .init           = nf_tables_init_net,
+       .pre_exit       = nf_tables_pre_exit_net,
+       .exit           = nf_tables_exit_net,
 };
 
 static int __init nf_tables_module_init(void)