[ Sasha's backport helper bot ]
Hi,
✅ All tests passed successfully. No issues detected. No action required from the submitter.
The upstream commit SHA1 provided is correct: 8965d42bcf54d42cbc72fe34a9d0ec3f8527debd
WARNING: Author mismatch between patch and upstream commit: Backport author: Pablo Neira Ayusopablo@netfilter.org Commit author: Florian Westphalfw@strlen.de
Status in newer kernel trees: 6.14.y | Present (exact SHA1) 6.12.y | Present (exact SHA1) 6.6.y | Present (different SHA1: 825a80817cf1) 6.1.y | Not found 5.15.y | Not found
Note: The patch differs from the upstream commit: --- 1: 8965d42bcf54d ! 1: b89d3ef279494 netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx @@ Metadata ## Commit message ## netfilter: nf_tables: pass nft_chain to destroy function, not nft_ctx
+ commit 8965d42bcf54d42cbc72fe34a9d0ec3f8527debd upstream. + It would be better to not store nft_ctx inside nft_trans object, the netlink ctx strucutre is huge and most of its information is never needed in places that use trans->ctx. @@ include/net/netfilter/nf_tables.h: static inline bool nft_chain_is_bound(struct
## net/netfilter/nf_tables_api.c ## @@ net/netfilter/nf_tables_api.c: static void nf_tables_chain_free_chain_rules(struct nft_chain *chain) - kvfree(chain->blob_next); + kvfree(chain->rules_next); }
-void nf_tables_chain_destroy(struct nft_ctx *ctx) @@ net/netfilter/nf_tables_api.c: void nf_tables_chain_destroy(struct nft_ctx *ctx) &basechain->hook_list, list) { list_del_rcu(&hook->list); @@ net/netfilter/nf_tables_api.c: static int nf_tables_addchain(struct nft_ctx *ctx, u8 family, u8 genmask, - err_trans: - nft_use_dec_restore(&table->use); + err_use: + nf_tables_unregister_hook(net, table, chain); err_destroy_chain: - nf_tables_chain_destroy(ctx); + nf_tables_chain_destroy(chain); @@ net/netfilter/nf_tables_api.c: static int nf_tables_addchain(struct nft_ctx *ctx return err; } @@ net/netfilter/nf_tables_api.c: static void nft_commit_release(struct nft_trans *trans) - if (nft_trans_chain_update(trans)) - nft_hooks_destroy(&nft_trans_chain_hooks(trans)); - else -- nf_tables_chain_destroy(&trans->ctx); -+ nf_tables_chain_destroy(nft_trans_chain(trans)); + kfree(nft_trans_chain_name(trans)); + break; + case NFT_MSG_DELCHAIN: +- nf_tables_chain_destroy(&trans->ctx); ++ nf_tables_chain_destroy(nft_trans_chain(trans)); break; case NFT_MSG_DELRULE: - case NFT_MSG_DESTROYRULE: + nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans)); @@ net/netfilter/nf_tables_api.c: static void nf_tables_abort_release(struct nft_trans *trans) - if (nft_trans_chain_update(trans)) - nft_hooks_destroy(&nft_trans_chain_hooks(trans)); - else -- nf_tables_chain_destroy(&trans->ctx); -+ nf_tables_chain_destroy(nft_trans_chain(trans)); + nf_tables_table_destroy(&trans->ctx); + break; + case NFT_MSG_NEWCHAIN: +- nf_tables_chain_destroy(&trans->ctx); ++ nf_tables_chain_destroy(nft_trans_chain(trans)); break; case NFT_MSG_NEWRULE: nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans)); @@ net/netfilter/nf_tables_api.c: static void __nft_release_table(struct net *net, - nf_tables_chain_destroy(&ctx); + nf_tables_chain_destroy(chain); } + list_del(&table->list); nf_tables_table_destroy(&ctx); - }
## net/netfilter/nft_immediate.c ## @@ net/netfilter/nft_immediate.c: static void nft_immediate_destroy(const struct nft_ctx *ctx, ---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-5.10.y | Success | Success |