From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Make sure the chain is not in the table list until the hook
registration returns success.
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
---
net/netfilter/nf_tables_api.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 7f08381..031aad9 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -868,8 +868,6 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
chain->net = net;
nla_strlcpy(chain->name, name, NFT_CHAIN_MAXNAMELEN);
- list_add_tail(&chain->list, &table->chains);
-
if (!(table->flags & NFT_TABLE_F_DORMANT) &&
chain->flags & NFT_BASE_CHAIN) {
err = nf_register_hook(&nft_base_chain(chain)->ops);
@@ -878,6 +876,7 @@ static int nf_tables_newchain(struct sock *nlsk, struct sk_buff *skb,
return err;
}
}
+ list_add_tail(&chain->list, &table->chains);
notify:
nf_tables_chain_notify(skb, nlh, table, chain, NFT_MSG_NEWCHAIN,
family);
--
1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
