From: Qingfang Deng nf_flow_table_init() adds the flowtable to the global flowtables list. However, tcf_ct_flow_table_get() sets the table's network namespace only after that call, leaving a window where the published table has a NULL namespace pointer. Set the namespace before calling nf_flow_table_init() so that flowtable list walkers can rely on it being initialized. This is required by: "netfilter: flowtable: check namespace before iterating flows" Signed-off-by: Qingfang Deng Reviewed-by: Xuanqiang Luo Signed-off-by: Pablo Neira Ayuso --- net/sched/act_ct.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c index 411e3dd92d07..e26c0d5b2176 100644 --- a/net/sched/act_ct.c +++ b/net/sched/act_ct.c @@ -349,10 +349,10 @@ static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params) ct_ft->nf_ft.type = &flowtable_ct; ct_ft->nf_ft.flags |= NF_FLOWTABLE_HW_OFFLOAD | NF_FLOWTABLE_COUNTER; + write_pnet(&ct_ft->nf_ft.net, net); err = nf_flow_table_init(&ct_ft->nf_ft); if (err) goto err_init; - write_pnet(&ct_ft->nf_ft.net, net); __module_get(THIS_MODULE); out_unlock: -- 2.47.3