netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx

commit 8965d42bcf54d42cbc72fe34a9d0ec3f8527debd upstream.

It would be better to not store nft_ctx inside nft_trans object,
the netlink ctx strucutre is huge and most of its information is
never needed in places that use trans->ctx.

Avoid/reduce its usage if possible, no runtime behaviour change
intended.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Stable-dep-of: c03d278fdf35 ("netfilter: nf_tables: wait for rcu grace period on net_device removal")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index d11398aa642e6ab59782b3f3cd6232d9c7d279a4..41abb5982348fca03b6712c0c383945548df607a 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -1121,7 +1121,7 @@ static inline bool nft_chain_is_bound(struct nft_chain *chain)
 
 int nft_chain_add(struct nft_table *table, struct nft_chain *chain);
 void nft_chain_del(struct nft_chain *chain);
-void nf_tables_chain_destroy(struct nft_ctx *ctx);
+void nf_tables_chain_destroy(struct nft_chain *chain);
 
 struct nft_stats {
        u64                     bytes;

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 656c4fb76773dadb045330999fd3b97a8d61c97c..dc1e11c0b16854ce3d04aef0902c6f3857e7941b 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2034,9 +2034,9 @@ static void nf_tables_chain_free_chain_rules(struct nft_chain *chain)
        kvfree(chain->blob_next);
 }
 
-void nf_tables_chain_destroy(struct nft_ctx *ctx)
+void nf_tables_chain_destroy(struct nft_chain *chain)
 {
-       struct nft_chain *chain = ctx->chain;
+       const struct nft_table *table = chain->table;
        struct nft_hook *hook, *next;
 
        if (WARN_ON(chain->use > 0))
@@ -2048,7 +2048,7 @@ void nf_tables_chain_destroy(struct nft_ctx *ctx)
        if (nft_is_base_chain(chain)) {
                struct nft_base_chain *basechain = nft_base_chain(chain);
 
-               if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) {
+               if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) {
                        list_for_each_entry_safe(hook, next,
                                                 &basechain->hook_list, list) {
                                list_del_rcu(&hook->list);
@@ -2515,7 +2515,7 @@ err_chain_add:
 err_trans:
        nft_use_dec_restore(&table->use);
 err_destroy_chain:
-       nf_tables_chain_destroy(ctx);
+       nf_tables_chain_destroy(chain);
 
        return err;
 }
@@ -8994,7 +8994,7 @@ static void nft_commit_release(struct nft_trans *trans)
                kfree(nft_trans_chain_name(trans));
                break;
        case NFT_MSG_DELCHAIN:
-               nf_tables_chain_destroy(&trans->ctx);
+               nf_tables_chain_destroy(nft_trans_chain(trans));
                break;
        case NFT_MSG_DELRULE:
                nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
@@ -9955,7 +9955,7 @@ static void nf_tables_abort_release(struct nft_trans *trans)
                nf_tables_table_destroy(&trans->ctx);
                break;
        case NFT_MSG_NEWCHAIN:
-               nf_tables_chain_destroy(&trans->ctx);
+               nf_tables_chain_destroy(nft_trans_chain(trans));
                break;
        case NFT_MSG_NEWRULE:
                nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
@@ -10677,7 +10677,7 @@ int __nft_release_basechain(struct nft_ctx *ctx)
        }
        nft_chain_del(ctx->chain);
        nft_use_dec(&ctx->table->use);
-       nf_tables_chain_destroy(ctx);
+       nf_tables_chain_destroy(ctx->chain);
 
        return 0;
 }
@@ -10753,10 +10753,9 @@ static void __nft_release_table(struct net *net, struct nft_table *table)
                nft_obj_destroy(&ctx, obj);
        }
        list_for_each_entry_safe(chain, nc, &table->chains, list) {
-               ctx.chain = chain;
                nft_chain_del(chain);
                nft_use_dec(&table->use);
-               nf_tables_chain_destroy(&ctx);
+               nf_tables_chain_destroy(chain);
        }
        nf_tables_table_destroy(&ctx);
 }

diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
index 55fcf0280c5c3c5bb3f7d13c6263eae4e2f05512..731511d58b7caf1d7a5c0b4f29b7fc886f82258f 100644 (file)
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -221,7 +221,7 @@ static void nft_immediate_destroy(const struct nft_ctx *ctx,
                        list_del(&rule->list);
                        nf_tables_rule_destroy(&chain_ctx, rule);
                }
-               nf_tables_chain_destroy(&chain_ctx);
+               nf_tables_chain_destroy(chain);
                break;
        default:
                break;