mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-22 08:49:45 +00:00
netfilter: nft_log: perform module load from nf_tables
modprobe calls from the nf_logger_find_get() API causes deadlock in very special cases because they occur with the nf_tables transaction mutex held. In the specific case of nf_log, deadlock is via: A nf_tables -> transaction mutex -> nft_log -> modprobe -> nf_log_syslog \ -> pernet_ops rwsem -> wait for C B netlink event -> rtnl_mutex -> nf_tables transaction mutex -> wait for A C close() -> ip6mr_sk_done -> rtnl_mutex -> wait for B Earlier patch added NFLOG/xt_LOG module softdeps to avoid the need to load the backend module during a transaction. For nft_log we would have to add a softdep for both nfnetlink_log or nf_log_syslog, since we do not know in advance which of the two backends are going to be configured. This defers the modprobe op until after the transaction mutex is released. Tested-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
a38b5b56d6
commit
cefa31a9d4
4 changed files with 27 additions and 6 deletions
|
@ -1562,4 +1562,9 @@ void nf_tables_trans_destroy_flush_work(void);
|
|||
int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result);
|
||||
__be64 nf_jiffies64_to_msecs(u64 input);
|
||||
|
||||
#ifdef CONFIG_MODULES
|
||||
__printf(2, 3) int nft_request_module(struct net *net, const char *fmt, ...);
|
||||
#else
|
||||
static inline int nft_request_module(struct net *net, const char *fmt, ...) { return -ENOENT; }
|
||||
#endif
|
||||
#endif /* _NET_NF_TABLES_H */
|
||||
|
|
|
@ -170,9 +170,6 @@ int nf_logger_find_get(int pf, enum nf_log_type type)
|
|||
return 0;
|
||||
}
|
||||
|
||||
if (rcu_access_pointer(loggers[pf][type]) == NULL)
|
||||
request_module("nf-logger-%u-%u", pf, type);
|
||||
|
||||
rcu_read_lock();
|
||||
logger = rcu_dereference(loggers[pf][type]);
|
||||
if (logger == NULL)
|
||||
|
|
|
@ -586,8 +586,8 @@ struct nft_module_request {
|
|||
};
|
||||
|
||||
#ifdef CONFIG_MODULES
|
||||
static __printf(2, 3) int nft_request_module(struct net *net, const char *fmt,
|
||||
...)
|
||||
__printf(2, 3) int nft_request_module(struct net *net, const char *fmt,
|
||||
...)
|
||||
{
|
||||
char module_name[MODULE_NAME_LEN];
|
||||
struct nft_module_request *req;
|
||||
|
@ -620,6 +620,7 @@ static __printf(2, 3) int nft_request_module(struct net *net, const char *fmt,
|
|||
|
||||
return -EAGAIN;
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(nft_request_module);
|
||||
#endif
|
||||
|
||||
static void lockdep_nfnl_nft_mutex_not_held(void)
|
||||
|
|
|
@ -128,6 +128,20 @@ static const struct nla_policy nft_log_policy[NFTA_LOG_MAX + 1] = {
|
|||
[NFTA_LOG_FLAGS] = { .type = NLA_U32 },
|
||||
};
|
||||
|
||||
static int nft_log_modprobe(struct net *net, enum nf_log_type t)
|
||||
{
|
||||
switch (t) {
|
||||
case NF_LOG_TYPE_LOG:
|
||||
return nft_request_module(net, "%s", "nf_log_syslog");
|
||||
case NF_LOG_TYPE_ULOG:
|
||||
return nft_request_module(net, "%s", "nfnetlink_log");
|
||||
case NF_LOG_TYPE_MAX:
|
||||
break;
|
||||
}
|
||||
|
||||
return -ENOENT;
|
||||
}
|
||||
|
||||
static int nft_log_init(const struct nft_ctx *ctx,
|
||||
const struct nft_expr *expr,
|
||||
const struct nlattr * const tb[])
|
||||
|
@ -197,8 +211,12 @@ static int nft_log_init(const struct nft_ctx *ctx,
|
|||
return 0;
|
||||
|
||||
err = nf_logger_find_get(ctx->family, li->type);
|
||||
if (err < 0)
|
||||
if (err < 0) {
|
||||
if (nft_log_modprobe(ctx->net, li->type) == -EAGAIN)
|
||||
err = -EAGAIN;
|
||||
|
||||
goto err1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
|
|
Loading…
Reference in a new issue