Commit 70b6f46a authored by Phil Sutter's avatar Phil Sutter Committed by Pablo Neira Ayuso
Browse files

netfilter: ipset: Fix for recursive locking warning 



With CONFIG_PROVE_LOCKING, when creating a set of type bitmap:ip, adding
it to a set of type list:set and populating it from iptables SET target
triggers a kernel warning:

| WARNING: possible recursive locking detected
| 6.12.0-rc7-01692-g5e9a28f41134-dirty #594 Not tainted
| --------------------------------------------
| ping/4018 is trying to acquire lock:
| ffff8881094a6848 (&set->lock){+.-.}-{2:2}, at: ip_set_add+0x28c/0x360 [ip_set]
|
| but task is already holding lock:
| ffff88811034c048 (&set->lock){+.-.}-{2:2}, at: ip_set_add+0x28c/0x360 [ip_set]

This is a false alarm: ipset does not allow nested list:set type, so the
loop in list_set_kadd() can never encounter the outer set itself. No
other set type supports embedded sets, so this is the only case to
consider.

To avoid the false report, create a distinct lock class for list:set
type ipset locks.

Fixes: f830837f ("netfilter: ipset: list:set set type support")
Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent cf2c9742

net/netfilter/ipset/ip_set_list_set.c

+3 −0
Original line number Diff line number Diff line
@@ -611,6 +611,8 @@ init_list_set(struct net *net, struct ip_set *set, u32 size) 
	return true;

}



static struct lock_class_key list_set_lockdep_key;



static int

list_set_create(struct net *net, struct ip_set *set, struct nlattr *tb[],

		u32 flags)
@@ -627,6 +629,7 @@ list_set_create(struct net *net, struct ip_set *set, struct nlattr *tb[], 
	if (size < IP_SET_LIST_MIN_SIZE)

		size = IP_SET_LIST_MIN_SIZE;



	lockdep_set_class(&set->lock, &list_set_lockdep_key);

	set->variant = &set_variant;

	set->dsize = ip_set_elem_len(set, tb, sizeof(struct set_elem),

				     __alignof__(struct set_elem));