|
 |
576484 |
From 66b9f92ef41de90fc2b0359247c36bc6d128233d Mon Sep 17 00:00:00 2001
|
|
|
576484 |
From: Phil Sutter <phil@nwl.cc>
|
|
|
576484 |
Date: Fri, 28 Feb 2020 20:32:13 +0100
|
|
|
576484 |
Subject: [PATCH] nft: cache: Fix nft_release_cache() under stress
|
|
|
576484 |
|
|
|
576484 |
iptables-nft-restore calls nft_action(h, NFT_COMPAT_COMMIT) for each
|
|
|
576484 |
COMMIT line in input. When restoring a dump containing multiple large
|
|
|
576484 |
tables, chances are nft_rebuild_cache() has to run multiple times.
|
|
|
576484 |
|
|
|
576484 |
If the above happens, consecutive table contents are added to __cache[1]
|
|
|
576484 |
which nft_rebuild_cache() then frees, so next commit attempt accesses
|
|
|
576484 |
invalid memory.
|
|
|
576484 |
|
|
|
576484 |
Fix this by making nft_release_cache() (called after each successful
|
|
|
576484 |
commit) return things into pre-rebuild state again, but keeping the
|
|
|
576484 |
fresh cache copy.
|
|
|
576484 |
|
|
|
576484 |
Fixes: f6ad231d698c7 ("nft: keep original cache in case of ERESTART")
|
|
|
576484 |
Signed-off-by: Phil Sutter <phil@nwl.cc>
|
|
|
576484 |
(cherry picked from commit c550c81fd373e5753103d20f7902171f0fa79807)
|
|
|
576484 |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
576484 |
---
|
|
|
576484 |
iptables/nft-cache.c | 10 ++++++++--
|
|
|
576484 |
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
|
576484 |
|
|
|
576484 |
diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
|
|
|
576484 |
index 7345a27e2894b..6f21f2283e0fb 100644
|
|
|
576484 |
--- a/iptables/nft-cache.c
|
|
|
576484 |
+++ b/iptables/nft-cache.c
|
|
|
576484 |
@@ -647,8 +647,14 @@ void nft_rebuild_cache(struct nft_handle *h)
|
|
|
576484 |
|
|
|
576484 |
void nft_release_cache(struct nft_handle *h)
|
|
|
576484 |
{
|
|
|
576484 |
- if (h->cache_index)
|
|
|
576484 |
- flush_cache(h, &h->__cache[0], NULL);
|
|
|
576484 |
+ if (!h->cache_index)
|
|
|
576484 |
+ return;
|
|
|
576484 |
+
|
|
|
576484 |
+ flush_cache(h, &h->__cache[0], NULL);
|
|
|
576484 |
+ memcpy(&h->__cache[0], &h->__cache[1], sizeof(h->__cache[0]));
|
|
|
576484 |
+ memset(&h->__cache[1], 0, sizeof(h->__cache[1]));
|
|
|
576484 |
+ h->cache_index = 0;
|
|
|
576484 |
+ h->cache = &h->__cache[0];
|
|
|
576484 |
}
|
|
|
576484 |
|
|
|
576484 |
struct nftnl_table_list *nftnl_table_list_get(struct nft_handle *h)
|
|
|
576484 |
--
|
|
|
576484 |
2.25.1
|
|
|
576484 |
|