On 9 December 2015 at 20:55, Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > We have to release the existing objects on netns removal otherwise we > leak them. Chains are unregistered in first place to make sure no > packets are walking on our rules and sets anymore. > > Reported-by: Patrick McHardy <kaber@xxxxxxxxx> > Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> > --- > v2: Unregister chains in first place to make sure no packets are walking > over rules and sets anymore. > > net/netfilter/nf_tables_api.c | 43 ++++++++++++++++++++++++++++++++++++++++++- > 1 file changed, 42 insertions(+), 1 deletion(-) > I've run a kernel with this patch, did some tests regarding netns and nftables, and found no problems so far :-) Tested-by: Arturo Borrero Gonzalez <arturo.borrero.glez@xxxxxxxxx> -- Arturo Borrero González -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
