[Devel] [PATCH RHEL7 COMMIT] ms/netfilter: x_tables: set module owner for icmp(6) matches

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-1062.4.2.vz7.116.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1062.4.2.vz7.116.5
------>
commit 3950e4d2a89e17b5963106257134c9388bb2da67
Author: Florian Westphal <fw at strlen.de>
Date:   Wed Jul 4 20:25:32 2018 +0200

    ms/netfilter: x_tables: set module owner for icmp(6) matches
    
    nft_compat relies on xt_request_find_match to increment
    refcount of the module that provides the match/target.
    
    The (builtin) icmp matches did't set the module owner so it
    was possible to rmmod ip(6)tables while icmp extensions were still in use.
    
    Signed-off-by: Florian Westphal <fw at strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
    
    https://jira.sw.ru/browse/PSBM-99593
    
    (cherry picked from commit d376bef9c29b3c65aeee4e785fffcd97ef0a9a81)
    Signed-off-by: Vasily Averin <vvs at virtuozzo.com>
---
 net/ipv4/netfilter/ip_tables.c  | 1 +
 net/ipv6/netfilter/ip6_tables.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 8946972faf47..a9aa42113cf7 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -2104,6 +2104,7 @@ static struct xt_match ipt_builtin_mt[] __read_mostly = {
 		.checkentry = icmp_checkentry,
 		.proto      = IPPROTO_ICMP,
 		.family     = NFPROTO_IPV4,
+		.me	    = THIS_MODULE,
 	},
 };
 
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 33819262eff4..78e5c4883a30 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -2099,6 +2099,7 @@ static struct xt_match ip6t_builtin_mt[] __read_mostly = {
 		.checkentry = icmp6_checkentry,
 		.proto      = IPPROTO_ICMPV6,
 		.family     = NFPROTO_IPV6,
+		.me	    = THIS_MODULE,
 	},
 };