mnl_genid_get can fail and in this case not update the genid which leads
to a busy loop that never recovers.
To avoid that check the return value and abort __nft_build_cache
if mnl_genid_get fails.
Signed-off-by: Christian Ehrhardt <christian.ehrhardt@xxxxxxxxxxxxx>
---
iptables/nft.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/iptables/nft.c b/iptables/nft.c
index ae3740be..c9b7edbb 100644
--- a/iptables/nft.c
+++ b/iptables/nft.c
@@ -1597,11 +1597,13 @@ static void __nft_build_cache(struct nft_handle *h)
uint32_t genid_start, genid_stop;
retry:
- mnl_genid_get(h, &genid_start);
+ if (mnl_genid_get(h, &genid_start) == -1)
+ goto fatal;
fetch_chain_cache(h);
fetch_rule_cache(h);
h->have_cache = true;
- mnl_genid_get(h, &genid_stop);
+ if (mnl_genid_get(h, &genid_stop) == -1)
+ goto fatal;
if (genid_start != genid_stop) {
flush_chain_cache(h, NULL);
@@ -1609,6 +1611,10 @@ retry:
}
h->nft_genid = genid_start;
+
+fatal:
+ flush_chain_cache(h, NULL);
+ h->have_cache = false;
}
void nft_build_cache(struct nft_handle *h)
@@ -1651,6 +1657,8 @@ struct nftnl_chain_list *nft_chain_list_get(struct nft_handle *h,
return NULL;
nft_build_cache(h);
+ if (!h->have_cache)
+ return NULL;
return h->cache->table[t->type].chains;
}
@@ -2047,6 +2055,8 @@ int nft_chain_user_rename(struct nft_handle *h,const char *chain,
static struct nftnl_table_list *nftnl_table_list_get(struct nft_handle *h)
{
nft_build_cache(h);
+ if (!h->have_cache)
+ return NULL;
return h->cache->tables;
}
--
2.22.0
