]> git.ipfire.org Git - thirdparty/iptables.git/commit
nft: cache: Fix nft_release_cache() under stress
authorPhil Sutter <phil@nwl.cc>
Fri, 28 Feb 2020 19:32:13 +0000 (20:32 +0100)
committerPhil Sutter <phil@nwl.cc>
Fri, 6 Mar 2020 15:55:56 +0000 (16:55 +0100)
commitc550c81fd373e5753103d20f7902171f0fa79807
treedc1728b92e6e4d06fca842eed96bae694aad8739
parentf56d91bd80f0e86aaad56a32ddc84f373bb80745
nft: cache: Fix nft_release_cache() under stress

iptables-nft-restore calls nft_action(h, NFT_COMPAT_COMMIT) for each
COMMIT line in input. When restoring a dump containing multiple large
tables, chances are nft_rebuild_cache() has to run multiple times.

If the above happens, consecutive table contents are added to __cache[1]
which nft_rebuild_cache() then frees, so next commit attempt accesses
invalid memory.

Fix this by making nft_release_cache() (called after each successful
commit) return things into pre-rebuild state again, but keeping the
fresh cache copy.

Fixes: f6ad231d698c7 ("nft: keep original cache in case of ERESTART")
Signed-off-by: Phil Sutter <phil@nwl.cc>
iptables/nft-cache.c