[Devel] [PATCH RH7] netfilter: nf_tables: fix register ordering

[Vasily Averin]

backport of ML commit d209df3e7f7

We must register nfnetlink ops last, as that exposes nf_tables to
userspace.  Without this, we could theoretically get nfnetlink request
before net->nft state has been initialized.

Fixes: 99633ab29b213 ("netfilter: nf_tables: complete net namespace support")
Signed-off-by: Florian Westphal <fw at strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>

changes:
- backported to RHEL78
- added nf_tables_module_exit() reorder, taken from ML commit 71ad00c50d7

https://jira.sw.ru/browse/PSBM-101549

Signed-off-by: Vasily Averin <vvs at virtuozzo.com>
---
 net/netfilter/nf_tables_api.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 613f67f0e8d3..f5bc4a95d412 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4743,25 +4743,32 @@ static int __init nf_tables_module_init(void)
 {
 	int err;
 
-	err = nf_tables_core_module_init();
+	err = register_pernet_subsys(&nf_tables_net_ops);
 	if (err < 0)
 		return err;
 
+	err = nf_tables_core_module_init();
+	if (err < 0)
+		goto err1;
+
+	/* must be last */
 	err = nfnetlink_subsys_register(&nf_tables_subsys);
 	if (err < 0)
-		goto err;
+		goto err2;
 
 	pr_info("nf_tables: (c) 2007-2009 Patrick McHardy <kaber at trash.net>\n");
-	return register_pernet_subsys(&nf_tables_net_ops);
-err:
+	return err;
+err2:
 	nf_tables_core_module_exit();
+err1:
+	unregister_pernet_subsys(&nf_tables_net_ops);
 	return err;
 }
 
 static void __exit nf_tables_module_exit(void)
 {
-	unregister_pernet_subsys(&nf_tables_net_ops);
 	nfnetlink_subsys_unregister(&nf_tables_subsys);
+	unregister_pernet_subsys(&nf_tables_net_ops);
 	rcu_barrier();
 	nf_tables_core_module_exit();
 }
-- 
2.17.1