tree 0e33bf5e9bac4ac772b45d41899ca16024c2ff7e
parent b8ecbee67c732ef9fc47fcf50aed6b7bb6231d98
author Pablo Neira Ayuso <pablo@netfilter.org> 1390655031 +0100
committer Pablo Neira Ayuso <pablo@netfilter.org> 1391683566 +0100

netfilter: nf_tables: fix racy rule deletion

We may lost race if we flush the rule-set (which happens asynchronously
via call_rcu) and we try to remove the table (that userspace assumes
to be empty).

Fix this by recovering synchronous rule and chain deletion. This was
introduced time ago before we had no batch support, and synchronous
rule deletion performance was not good. Now that we have the batch
support, we can just postpone the purge of old rule in a second step
in the commit phase. All object deletions are synchronous after this
patch.

As a side effect, we save memory as we don't need rcu_head per rule
anymore.

Cc: Patrick McHardy <kaber@trash.net>
Reported-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>