[nf-next PATCH v2 0/5] Address Sashiko review of NAT hook dump code
Phil Sutter <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.netfilter.devel |
|---|---|
| Message-ID | <[email protected]> |
Changes since v1:
- New patch 1
- Fixed three aspects of patch 3
- Fixed two issues of patch 5
Patch 1 fixes a bug (actually, two) in old code. Latter patches benefit
from the fix it implements.
Patch 2 is mere preparation to add the missing case handling to
nfnl_hook_dump_nat().
Patch 3 fixes for missing READ_ONCE() calls when addressing hook ops
array elements.
Patch 4 adds missing multipart dump support to nfnl_hook_dump_nat.
Patch 5 adds code to detect and mitigate concurrent hook updates while
amidst a multipart dump to nfnl_hook_dump_nat.
Link: https://sashiko.dev/#/patchset/20260702105003.13550-2-fw%40strlen.de
Phil Sutter (5):
netfilter: nfnetlink_hook: Fix for EINTR due to index too large
netfilter: nfnetlink_hook: Pass cb object to nfnl_hook_dump_nat()
netfilter: nfnetlink_hook: Address hook ops using READ_ONCE()
netfilter: nfnetlink_hook: Handle multipart NAT hook dumps
netfilter: nfnetlink_hook: Fix for concurrent NAT hooks dump and
change
net/netfilter/nfnetlink_hook.c | 75 +++++++++++++++++++++++-----------
1 file changed, 52 insertions(+), 23 deletions(-)
--
2.54.0