mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 01:10:04 +00:00
4c05ec4738
basechain->stats is rcu protected data which is updated from
nft_chain_stats_replace(). This function is executed from the commit
phase which holds the pernet nf_tables commit mutex - not the global
nfnetlink subsystem mutex.
Test commands to reproduce the problem are:
%iptables-nft -I INPUT
%iptables-nft -Z
%iptables-nft -Z
This patch uses RCU calls to handle basechain->stats updates to fix a
splat that looks like:
[89279.358755] =============================
[89279.363656] WARNING: suspicious RCU usage
[89279.368458] 4.20.0-rc2+ #44 Tainted: G W L
[89279.374661] -----------------------------
[89279.379542] net/netfilter/nf_tables_api.c:1404 suspicious rcu_dereference_protected() usage!
[...]
[89279.406556] 1 lock held by iptables-nft/5225:
[89279.411728] #0: 00000000bf45a000 (&net->nft.commit_mutex){+.+.}, at: nf_tables_valid_genid+0x1f/0x70 [nf_tables]
[89279.424022] stack backtrace:
[89279.429236] CPU: 0 PID: 5225 Comm: iptables-nft Tainted: G W L 4.20.0-rc2+ #44
[89279.430135] Call Trace:
[89279.430135] dump_stack+0xc9/0x16b
[89279.430135] ? show_regs_print_info+0x5/0x5
[89279.430135] ? lockdep_rcu_suspicious+0x117/0x160
[89279.430135] nft_chain_commit_update+0x4ea/0x640 [nf_tables]
[89279.430135] ? sched_clock_local+0xd4/0x140
[89279.430135] ? check_flags.part.35+0x440/0x440
[89279.430135] ? __rhashtable_remove_fast.constprop.67+0xec0/0xec0 [nf_tables]
[89279.430135] ? sched_clock_cpu+0x126/0x170
[89279.430135] ? find_held_lock+0x39/0x1c0
[89279.430135] ? hlock_class+0x140/0x140
[89279.430135] ? is_bpf_text_address+0x5/0xf0
[89279.430135] ? check_flags.part.35+0x440/0x440
[89279.430135] ? __lock_is_held+0xb4/0x140
[89279.430135] nf_tables_commit+0x2555/0x39c0 [nf_tables]
Fixes: f102d66b33 ("netfilter: nf_tables: use dedicated mutex to guard transactions")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
68 lines
2.2 KiB
C
68 lines
2.2 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _NFNETLINK_H
|
|
#define _NFNETLINK_H
|
|
|
|
#include <linux/netlink.h>
|
|
#include <linux/capability.h>
|
|
#include <net/netlink.h>
|
|
#include <uapi/linux/netfilter/nfnetlink.h>
|
|
|
|
struct nfnl_callback {
|
|
int (*call)(struct net *net, struct sock *nl, struct sk_buff *skb,
|
|
const struct nlmsghdr *nlh,
|
|
const struct nlattr * const cda[],
|
|
struct netlink_ext_ack *extack);
|
|
int (*call_rcu)(struct net *net, struct sock *nl, struct sk_buff *skb,
|
|
const struct nlmsghdr *nlh,
|
|
const struct nlattr * const cda[],
|
|
struct netlink_ext_ack *extack);
|
|
int (*call_batch)(struct net *net, struct sock *nl, struct sk_buff *skb,
|
|
const struct nlmsghdr *nlh,
|
|
const struct nlattr * const cda[],
|
|
struct netlink_ext_ack *extack);
|
|
const struct nla_policy *policy; /* netlink attribute policy */
|
|
const u_int16_t attr_count; /* number of nlattr's */
|
|
};
|
|
|
|
struct nfnetlink_subsystem {
|
|
const char *name;
|
|
__u8 subsys_id; /* nfnetlink subsystem ID */
|
|
__u8 cb_count; /* number of callbacks */
|
|
const struct nfnl_callback *cb; /* callback for individual types */
|
|
struct module *owner;
|
|
int (*commit)(struct net *net, struct sk_buff *skb);
|
|
int (*abort)(struct net *net, struct sk_buff *skb);
|
|
void (*cleanup)(struct net *net);
|
|
bool (*valid_genid)(struct net *net, u32 genid);
|
|
};
|
|
|
|
int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n);
|
|
int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem *n);
|
|
|
|
int nfnetlink_has_listeners(struct net *net, unsigned int group);
|
|
int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 portid,
|
|
unsigned int group, int echo, gfp_t flags);
|
|
int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error);
|
|
int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid,
|
|
int flags);
|
|
|
|
static inline u16 nfnl_msg_type(u8 subsys, u8 msg_type)
|
|
{
|
|
return subsys << 8 | msg_type;
|
|
}
|
|
|
|
void nfnl_lock(__u8 subsys_id);
|
|
void nfnl_unlock(__u8 subsys_id);
|
|
#ifdef CONFIG_PROVE_LOCKING
|
|
bool lockdep_nfnl_is_held(__u8 subsys_id);
|
|
#else
|
|
static inline bool lockdep_nfnl_is_held(__u8 subsys_id)
|
|
{
|
|
return true;
|
|
}
|
|
#endif /* CONFIG_PROVE_LOCKING */
|
|
|
|
#define MODULE_ALIAS_NFNL_SUBSYS(subsys) \
|
|
MODULE_ALIAS("nfnetlink-subsys-" __stringify(subsys))
|
|
|
|
#endif /* _NFNETLINK_H */
|