commit 3d483faa66639ad96d8373046c47f2b2d76fdf76
author Phil Sutter <phil@nwl.cc> Thu Nov 09 16:01:16 2023 +0100
committer Pablo Neira Ayuso <pablo@netfilter.org> Fri Dec 22 12:08:38 2023 +0100
tree a12daa3a6e7cebd9e9b5a587fec29e6f03b15a10
parent f649be6d9c84960e358f350914a0673411467b11

netfilter: nf_tables: Add locking for NFT_MSG_GETSETELEM_RESET requests

Set expressions' dump callbacks are not concurrency-safe per-se with
reset bit set. If two CPUs reset the same element at the same time,
values may underrun at least with element-attached counters and quotas.

Prevent this by introducing dedicated callbacks for nfnetlink and the
asynchronous dump handling to serialize access.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>