[Devel] [PATCH RHEL7 COMMIT] ms/netfilter: nf_tables: fix register ordering

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-1062.12.1.vz7.131.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1062.12.1.vz7.131.4
------>
commit bbf24e156b3169b0789d6c9166427904c2da1c84
Author: Vasily Averin <vvs at virtuozzo.com>
Date:   Thu Feb 27 12:49:19 2020 +0300

    ms/netfilter: nf_tables: fix register ordering
    
    backport of ML commit d209df3e7f7
    
    We must register nfnetlink ops last, as that exposes nf_tables to
    userspace.  Without this, we could theoretically get nfnetlink request
    before net->nft state has been initialized.
    
    Fixes: 99633ab29b213 ("netfilter: nf_tables: complete net namespace support")
    Signed-off-by: Florian Westphal <fw at strlen.de>
    Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>
    
    changes:
     - backported to RHEL7.7
     - added nf_tables_module_exit() reorder, taken from ML commit
       71ad00c50d77e ("netfilter: nf_tables: fix module unload race")
    
    https://jira.sw.ru/browse/PSBM-101549
    
    Signed-off-by: Vasily Averin <vvs at virtuozzo.com>
---
 net/netfilter/nf_tables_api.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 613f67f0e8d3c..f5bc4a95d4128 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4743,25 +4743,32 @@ static int __init nf_tables_module_init(void)
 {
 	int err;
 
-	err = nf_tables_core_module_init();
+	err = register_pernet_subsys(&nf_tables_net_ops);
 	if (err < 0)
 		return err;
 
+	err = nf_tables_core_module_init();
+	if (err < 0)
+		goto err1;
+
+	/* must be last */
 	err = nfnetlink_subsys_register(&nf_tables_subsys);
 	if (err < 0)
-		goto err;
+		goto err2;
 
 	pr_info("nf_tables: (c) 2007-2009 Patrick McHardy <kaber at trash.net>\n");
-	return register_pernet_subsys(&nf_tables_net_ops);
-err:
+	return err;
+err2:
 	nf_tables_core_module_exit();
+err1:
+	unregister_pernet_subsys(&nf_tables_net_ops);
 	return err;
 }
 
 static void __exit nf_tables_module_exit(void)
 {
-	unregister_pernet_subsys(&nf_tables_net_ops);
 	nfnetlink_subsys_unregister(&nf_tables_subsys);
+	unregister_pernet_subsys(&nf_tables_net_ops);
 	rcu_barrier();
 	nf_tables_core_module_exit();
 }