UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion 

[ Upstream commit 9adbb4198bf6cf3634032871118a7052aeaa573f ]

On rule delete we get:
 WARNING: suspicious RCU usage
 net/netfilter/nf_tables_api.c:3420 RCU-list traversed in non-reader section!!
 1 lock held by iptables/134:
   #0: ffff888008c4fcc8 (&nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid (include/linux/jiffies.h:101) nf_tables

Code is fine, no other CPU can change the list because we're holding
transaction mutex.

Pass the needed lockdep annotation to the iterator and fix
two comments for functions that are no longer restricted to rcu-only
context.

This is enough to resolve rule delete, but there are several other
missing annotations, added in followup-patches.

Fixes: 28875945ba ("rcu: Add support for consolidated-RCU reader checking")
Reported-by: Matthieu Baerts <matttbe@kernel.org>
Tested-by: Matthieu Baerts <matttbe@kernel.org>
Closes: https://lore.kernel.org/netfilter-devel/da27f17f-3145-47af-ad0f-7fd2a823623e@kernel.org/
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Florian Westphal 2024-11-04 10:41:13 +01:00 committed by Greg Kroah-Hartman
parent 6ee1c9849c
commit cd38d9cdf4
1 changed files with 13 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
net/netfilter/nf_tables_api.c
View File

@ -3349,13 +3349,15 @@ void nft_expr_destroy(const struct nft_ctx *ctx, struct nft_expr *expr)
* Rules * Rules
*/ */
static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain, static struct nft_rule *__nft_rule_lookup(const struct net *net,
const struct nft_chain *chain,
u64 handle) u64 handle)
{ {
struct nft_rule *rule; struct nft_rule *rule;
// FIXME: this sucks // FIXME: this sucks
list_for_each_entry_rcu(rule, &chain->rules, list) { list_for_each_entry_rcu(rule, &chain->rules, list,
lockdep_commit_lock_is_held(net)) {
if (handle == rule->handle) if (handle == rule->handle)
return rule; return rule;
} }
@ -3363,13 +3365,14 @@ static struct nft_rule *__nft_rule_lookup(const struct nft_chain *chain,
return ERR_PTR(-ENOENT); return ERR_PTR(-ENOENT);
} }
static struct nft_rule *nft_rule_lookup(const struct nft_chain *chain, static struct nft_rule *nft_rule_lookup(const struct net *net,
const struct nft_chain *chain,
const struct nlattr *nla) const struct nlattr *nla)
{ {
if (nla == NULL) if (nla == NULL)
return ERR_PTR(-EINVAL); return ERR_PTR(-EINVAL);
return __nft_rule_lookup(chain, be64_to_cpu(nla_get_be64(nla))); return __nft_rule_lookup(net, chain, be64_to_cpu(nla_get_be64(nla)));
} }
static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = { static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = {
@ -3661,7 +3664,7 @@ static int nf_tables_dump_rules_done(struct netlink_callback *cb)
return 0; return 0;
} }
/* called with rcu_read_lock held */ /* Caller must hold rcu read lock or transaction mutex */
static struct sk_buff * static struct sk_buff *
nf_tables_getrule_single(u32 portid, const struct nfnl_info *info, nf_tables_getrule_single(u32 portid, const struct nfnl_info *info,
const struct nlattr * const nla[], bool reset) const struct nlattr * const nla[], bool reset)
@ -3688,7 +3691,7 @@ nf_tables_getrule_single(u32 portid, const struct nfnl_info *info,
return ERR_CAST(chain); return ERR_CAST(chain);
} }
rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]); rule = nft_rule_lookup(net, chain, nla[NFTA_RULE_HANDLE]);
if (IS_ERR(rule)) { if (IS_ERR(rule)) {
NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
return ERR_CAST(rule); return ERR_CAST(rule);
@ -3961,7 +3964,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
if (nla[NFTA_RULE_HANDLE]) { if (nla[NFTA_RULE_HANDLE]) {
handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE])); handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE]));
rule = __nft_rule_lookup(chain, handle); rule = __nft_rule_lookup(net, chain, handle);
if (IS_ERR(rule)) { if (IS_ERR(rule)) {
NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]); NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_HANDLE]);
return PTR_ERR(rule); return PTR_ERR(rule);
@ -3983,7 +3986,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
if (nla[NFTA_RULE_POSITION]) { if (nla[NFTA_RULE_POSITION]) {
pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION])); pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
old_rule = __nft_rule_lookup(chain, pos_handle); old_rule = __nft_rule_lookup(net, chain, pos_handle);
if (IS_ERR(old_rule)) { if (IS_ERR(old_rule)) {
NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]); NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
return PTR_ERR(old_rule); return PTR_ERR(old_rule);
@ -4200,7 +4203,7 @@ static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info,
if (chain) { if (chain) {
if (nla[NFTA_RULE_HANDLE]) { if (nla[NFTA_RULE_HANDLE]) {
rule = nft_rule_lookup(chain, nla[NFTA_RULE_HANDLE]); rule = nft_rule_lookup(info->net, chain, nla[NFTA_RULE_HANDLE]);
if (IS_ERR(rule)) { if (IS_ERR(rule)) {
if (PTR_ERR(rule) == -ENOENT && if (PTR_ERR(rule) == -ENOENT &&
NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYRULE) NFNL_MSG_TYPE(info->nlh->nlmsg_type) == NFT_MSG_DESTROYRULE)
@ -7911,7 +7914,7 @@ static int nf_tables_dump_obj_done(struct netlink_callback *cb)
return 0; return 0;
} }
/* called with rcu_read_lock held */ /* Caller must hold rcu read lock or transaction mutex */
static struct sk_buff * static struct sk_buff *
nf_tables_getobj_single(u32 portid, const struct nfnl_info *info, nf_tables_getobj_single(u32 portid, const struct nfnl_info *info,
const struct nlattr * const nla[], bool reset) const struct nlattr * const nla[], bool reset)