nft_compat relies on xt_request_find_match/target to increment
refcount of the module that provides the match/target.
The builtin modules/targets currently did't set the module owner so it
was possible to rmmod ip(6)tables while extensions were still in use.
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
---
net/bridge/netfilter/ebtables.c | 1 +
net/ipv4/netfilter/ip_tables.c | 3 +++
net/ipv6/netfilter/ip6_tables.c | 3 +++
3 files changed, 7 insertions(+)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 491828713e0b..a1377db660fe 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -82,6 +82,7 @@ static struct xt_target ebt_standard_target = {
.compat_from_user = ebt_standard_compat_from_user,
.compat_to_user = ebt_standard_compat_to_user,
#endif
+ .me = THIS_MODULE,
};
static inline int
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index ca0dad90803a..57e7bfc80730 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1864,12 +1864,14 @@ static struct xt_target ipt_builtin_tg[] __read_mostly = {
.compat_from_user = compat_standard_from_user,
.compat_to_user = compat_standard_to_user,
#endif
+ .me = THIS_MODULE,
},
{
.name = XT_ERROR_TARGET,
.target = ipt_error,
.targetsize = XT_FUNCTION_MAXNAMELEN,
.family = NFPROTO_IPV4,
+ .me = THIS_MODULE,
},
};
@@ -1898,6 +1900,7 @@ static struct xt_match ipt_builtin_mt[] __read_mostly = {
.checkentry = icmp_checkentry,
.proto = IPPROTO_ICMP,
.family = NFPROTO_IPV4,
+ .me = THIS_MODULE,
},
};
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 7eab959734bc..5d21bf5f4319 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1875,12 +1875,14 @@ static struct xt_target ip6t_builtin_tg[] __read_mostly = {
.compat_from_user = compat_standard_from_user,
.compat_to_user = compat_standard_to_user,
#endif
+ .me = THIS_MODULE,
},
{
.name = XT_ERROR_TARGET,
.target = ip6t_error,
.targetsize = XT_FUNCTION_MAXNAMELEN,
.family = NFPROTO_IPV6,
+ .me = THIS_MODULE,
},
};
@@ -1909,6 +1911,7 @@ static struct xt_match ip6t_builtin_mt[] __read_mostly = {
.checkentry = icmp6_checkentry,
.proto = IPPROTO_ICMPV6,
.family = NFPROTO_IPV6,
+ .me = THIS_MODULE,
},
};
--
2.16.4
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
