[nf-next PATCH v2 0/5] Address Sashiko review of NAT hook dump code

Phil Sutter <[email protected]>
Newsgroups gmane.comp.security.firewalls.netfilter.devel
Message-ID <[email protected]>
Changes since v1:
- New patch 1
- Fixed three aspects of patch 3
- Fixed two issues of patch 5

Patch 1 fixes a bug (actually, two) in old code. Latter patches benefit
from the fix it implements.

Patch 2 is mere preparation to add the missing case handling to
nfnl_hook_dump_nat().

Patch 3 fixes for missing READ_ONCE() calls when addressing hook ops
array elements.

Patch 4 adds missing multipart dump support to nfnl_hook_dump_nat.

Patch 5 adds code to detect and mitigate concurrent hook updates while
amidst a multipart dump to nfnl_hook_dump_nat.

Link: https://sashiko.dev/#/patchset/20260702105003.13550-2-fw%40strlen.de

Phil Sutter (5):
  netfilter: nfnetlink_hook: Fix for EINTR due to index too large
  netfilter: nfnetlink_hook: Pass cb object to nfnl_hook_dump_nat()
  netfilter: nfnetlink_hook: Address hook ops using READ_ONCE()
  netfilter: nfnetlink_hook: Handle multipart NAT hook dumps
  netfilter: nfnetlink_hook: Fix for concurrent NAT hooks dump and
    change

 net/netfilter/nfnetlink_hook.c | 75 +++++++++++++++++++++++-----------
 1 file changed, 52 insertions(+), 23 deletions(-)

-- 
2.54.0
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.