netfilter: conntrack: fix removal of conntrack entries when l4tracker is removed

nf_ct_l4proto_unregister_one() leaves conntracks added by
to-be-removed tracker behind, nf_ct_l4proto_unregister has to iterate
for each protocol to be removed.

v2: call nf_ct_iterate_destroy without holding nf_ct_proto_mutex.

Fixes: 2c41f33c1b703 ("netfilter: move table iteration out of netns exit paths")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index 3007073..9f14b0d 100644 (file)
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -312,7 +312,9 @@ void nf_ct_l4proto_unregister_one(const struct nf_conntrack_l4proto *l4proto)
        __nf_ct_l4proto_unregister_one(l4proto);
        mutex_unlock(&nf_ct_proto_mutex);
 
-       synchronize_rcu();
+       synchronize_net();
+       /* Remove all contrack entries for this protocol */
+       nf_ct_iterate_destroy(kill_l4proto, (void *)l4proto);
 }
 EXPORT_SYMBOL_GPL(nf_ct_l4proto_unregister_one);
 
@@ -333,14 +335,17 @@ static void
 nf_ct_l4proto_unregister(const struct nf_conntrack_l4proto * const l4proto[],
                         unsigned int num_proto)
 {
+       int i;
+
        mutex_lock(&nf_ct_proto_mutex);
-       while (num_proto-- != 0)
-               __nf_ct_l4proto_unregister_one(l4proto[num_proto]);
+       for (i = 0; i < num_proto; i++)
+               __nf_ct_l4proto_unregister_one(l4proto[i]);
        mutex_unlock(&nf_ct_proto_mutex);
 
        synchronize_net();
-       /* Remove all contrack entries for this protocol */
-       nf_ct_iterate_destroy(kill_l4proto, (void *)l4proto);
+
+       for (i = 0; i < num_proto; i++)
+               nf_ct_iterate_destroy(kill_l4proto, (void *)l4proto[i]);
 }
 
 static int