netfilter: nf_tables: make all set structs const

They do not need to be writeable anymore.

v2: remove left-over __read_mostly annotation in set_pipapo.c (Stefano)

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 9a5f410287367531f90509f397257548f32a5600..d913cdb6a27becd127462e130336edb9654d201d 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -385,14 +385,10 @@ struct nft_set_ops {
  *      struct nft_set_type - nf_tables set type
  *
  *      @ops: set ops for this type
- *      @list: used internally
- *      @owner: module reference
  *      @features: features supported by the implementation
  */
 struct nft_set_type {
        const struct nft_set_ops        ops;
-       struct list_head                list;
-       struct module                   *owner;
        u32                             features;
 };
 #define to_set_type(o) container_of(o, struct nft_set_type, ops)

diff --git a/include/net/netfilter/nf_tables_core.h b/include/net/netfilter/nf_tables_core.h
index 29e7e10212678da116c24c708d8259ca68522ec0..3e30cc5d195b0315886989dbe1bea02699a41f27 100644 (file)
--- a/include/net/netfilter/nf_tables_core.h
+++ b/include/net/netfilter/nf_tables_core.h
@@ -69,12 +69,12 @@ extern const struct nft_expr_ops nft_payload_fast_ops;
 extern struct static_key_false nft_counters_enabled;
 extern struct static_key_false nft_trace_enabled;
 
-extern struct nft_set_type nft_set_rhash_type;
-extern struct nft_set_type nft_set_hash_type;
-extern struct nft_set_type nft_set_hash_fast_type;
-extern struct nft_set_type nft_set_rbtree_type;
-extern struct nft_set_type nft_set_bitmap_type;
-extern struct nft_set_type nft_set_pipapo_type;
+extern const struct nft_set_type nft_set_rhash_type;
+extern const struct nft_set_type nft_set_hash_type;
+extern const struct nft_set_type nft_set_hash_fast_type;
+extern const struct nft_set_type nft_set_rbtree_type;
+extern const struct nft_set_type nft_set_bitmap_type;
+extern const struct nft_set_type nft_set_pipapo_type;
 
 struct nft_expr;
 struct nft_regs;

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index f26a9b638d6c5a6cd296987c49b1b3c7727bc283..3bdf2d0259f6e1d526ab9735e237b91cc9d5e6f3 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3344,11 +3344,6 @@ nft_select_set_ops(const struct nft_ctx *ctx,
                        break;
                }
 
-               if (!try_module_get(type->owner))
-                       continue;
-               if (bops != NULL)
-                       module_put(to_set_type(bops)->owner);
-
                bops = ops;
                best = est;
        }
@@ -4047,10 +4042,8 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk,
                size = ops->privsize(nla, &desc);
 
        set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
-       if (!set) {
-               err = -ENOMEM;
-               goto err1;
-       }
+       if (!set)
+               return -ENOMEM;
 
        name = nla_strdup(nla[NFTA_SET_NAME], GFP_KERNEL);
        if (!name) {
@@ -4109,8 +4102,6 @@ err3:
        kfree(set->name);
 err2:
        kvfree(set);
-err1:
-       module_put(to_set_type(ops)->owner);
        return err;
 }
 
@@ -4120,7 +4111,6 @@ static void nft_set_destroy(struct nft_set *set)
                return;
 
        set->ops->destroy(set);
-       module_put(to_set_type(set->ops)->owner);
        kfree(set->name);
        kvfree(set);
 }

diff --git a/net/netfilter/nft_set_bitmap.c b/net/netfilter/nft_set_bitmap.c
index 87e8d9ba0c9b820738d650a631da6a6e51b9afad..1cb2e67e6e035450605d1be224f85d407fde7faf 100644 (file)
--- a/net/netfilter/nft_set_bitmap.c
+++ b/net/netfilter/nft_set_bitmap.c
@@ -293,8 +293,7 @@ static bool nft_bitmap_estimate(const struct nft_set_desc *desc, u32 features,
        return true;
 }
 
-struct nft_set_type nft_set_bitmap_type __read_mostly = {
-       .owner          = THIS_MODULE,
+const struct nft_set_type nft_set_bitmap_type = {
        .ops            = {
                .privsize       = nft_bitmap_privsize,
                .elemsize       = offsetof(struct nft_bitmap_elem, ext),

diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index d350a7cd3af0ff1a176fe6eef46a0bc7c48611b0..4d3f147e8d8dcf4e50a4eb126a61b02f69569991 100644 (file)
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -662,8 +662,7 @@ static bool nft_hash_fast_estimate(const struct nft_set_desc *desc, u32 features
        return true;
 }
 
-struct nft_set_type nft_set_rhash_type __read_mostly = {
-       .owner          = THIS_MODULE,
+const struct nft_set_type nft_set_rhash_type = {
        .features       = NFT_SET_MAP | NFT_SET_OBJECT |
                          NFT_SET_TIMEOUT | NFT_SET_EVAL,
        .ops            = {
@@ -686,8 +685,7 @@ struct nft_set_type nft_set_rhash_type __read_mostly = {
        },
 };
 
-struct nft_set_type nft_set_hash_type __read_mostly = {
-       .owner          = THIS_MODULE,
+const struct nft_set_type nft_set_hash_type = {
        .features       = NFT_SET_MAP | NFT_SET_OBJECT,
        .ops            = {
                .privsize       = nft_hash_privsize,
@@ -706,8 +704,7 @@ struct nft_set_type nft_set_hash_type __read_mostly = {
        },
 };
 
-struct nft_set_type nft_set_hash_fast_type __read_mostly = {
-       .owner          = THIS_MODULE,
+const struct nft_set_type nft_set_hash_fast_type = {
        .features       = NFT_SET_MAP | NFT_SET_OBJECT,
        .ops            = {
                .privsize       = nft_hash_privsize,

diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
index 4fc0c924ed5da0cc7adb99d4ba1c0ec8df636f1c..34a1678cf290ab24d80052d4da657f42792c0f14 100644 (file)
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -2081,8 +2081,7 @@ static void nft_pipapo_gc_init(const struct nft_set *set)
        priv->last_gc = jiffies;
 }
 
-struct nft_set_type nft_set_pipapo_type __read_mostly = {
-       .owner          = THIS_MODULE,
+const struct nft_set_type nft_set_pipapo_type = {
        .features       = NFT_SET_INTERVAL | NFT_SET_MAP | NFT_SET_OBJECT |
                          NFT_SET_TIMEOUT,
        .ops            = {

diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index 5000b938ab1eaf71af879b81b55ce0d226a3f1dc..172ef8189f997c20a861a5f99525dff9d9a12f29 100644 (file)
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -481,8 +481,7 @@ static bool nft_rbtree_estimate(const struct nft_set_desc *desc, u32 features,
        return true;
 }
 
-struct nft_set_type nft_set_rbtree_type __read_mostly = {
-       .owner          = THIS_MODULE,
+const struct nft_set_type nft_set_rbtree_type = {
        .features       = NFT_SET_INTERVAL | NFT_SET_MAP | NFT_SET_OBJECT | NFT_SET_TIMEOUT,
        .ops            = {
                .privsize       = nft_rbtree_privsize,