netfilter: nf_tables: check if bind callback fails and unbind if hook registration...

Undo the callback binding before unregistering the existing hooks. This
should also check for error of the bind setup call.

Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
Signed-off-by: wenxu <wenxu@ucloud.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 4f0d880a8496564bd1fb5594c540d0557e4afcb3..9340b976d85ca55a890b97a95547f6a3c1d0e9dd 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6006,12 +6006,20 @@ static int nft_register_flowtable_net_hooks(struct net *net,
                        }
                }
 
-               flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
-                                           FLOW_BLOCK_BIND);
-               err = nf_register_net_hook(net, &hook->ops);
+               err = flowtable->data.type->setup(&flowtable->data,
+                                                 hook->ops.dev,
+                                                 FLOW_BLOCK_BIND);
                if (err < 0)
                        goto err_unregister_net_hooks;
 
+               err = nf_register_net_hook(net, &hook->ops);
+               if (err < 0) {
+                       flowtable->data.type->setup(&flowtable->data,
+                                                   hook->ops.dev,
+                                                   FLOW_BLOCK_UNBIND);
+                       goto err_unregister_net_hooks;
+               }
+
                i++;
        }