|
 |
2e3e3a |
From 3b98024d952d265d50078c5b7ad04c9c65373733 Mon Sep 17 00:00:00 2001
|
|
|
11bc0b |
From: Phil Sutter <psutter@redhat.com>
|
|
|
11bc0b |
Date: Fri, 29 May 2020 19:33:22 +0200
|
|
|
11bc0b |
Subject: [PATCH] nft: cache: Reset genid when rebuilding cache
|
|
|
11bc0b |
|
|
|
11bc0b |
This is required in order to avoid a cache rebuild loop if
|
|
|
11bc0b |
iptables-nft-restore is called with '--test' parameter and a dump
|
|
|
11bc0b |
containing more than a single table.
|
|
|
11bc0b |
|
|
|
11bc0b |
If non-zero, __nft_build_cache() never updates genid and therefore the
|
|
|
11bc0b |
incorrect genid (caused by increment in nft_action()) is never
|
|
|
11bc0b |
corrected.
|
|
|
11bc0b |
|
|
|
11bc0b |
This is a RHEL-only fix, upstream rewrote the whole cache logic which
|
|
|
11bc0b |
implicitly resolved this problem.
|
|
|
11bc0b |
|
|
|
11bc0b |
Fixes: 200bc39965149 ("nft: cache: Fix iptables-save segfault under stress")
|
|
|
11bc0b |
Signed-off-by: Phil Sutter <psutter@redhat.com>
|
|
|
11bc0b |
---
|
|
|
11bc0b |
iptables/nft-cache.c | 1 +
|
|
|
11bc0b |
1 file changed, 1 insertion(+)
|
|
|
11bc0b |
|
|
|
11bc0b |
diff --git a/iptables/nft-cache.c b/iptables/nft-cache.c
|
|
|
11bc0b |
index 07265b7795e4f..bc6e7f7eaebfb 100644
|
|
|
11bc0b |
--- a/iptables/nft-cache.c
|
|
|
11bc0b |
+++ b/iptables/nft-cache.c
|
|
|
11bc0b |
@@ -629,6 +629,7 @@ void nft_rebuild_cache(struct nft_handle *h)
|
|
|
11bc0b |
if (h->cache_level)
|
|
|
11bc0b |
__nft_flush_cache(h);
|
|
|
11bc0b |
|
|
|
11bc0b |
+ h->nft_genid = 0;
|
|
|
11bc0b |
h->cache_level = NFT_CL_NONE;
|
|
|
11bc0b |
__nft_build_cache(h, level, NULL, NULL, NULL);
|
|
|
11bc0b |
}
|
|
|
11bc0b |
--
|
|
|
2e3e3a |
2.26.2
|
|
|
11bc0b |
|