Commit b3e8f29d authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: avoid false-positive lockdep splats with flowtables 



The transaction mutex prevents concurrent add/delete, its ok to iterate
those lists outside of rcu read side critical sections.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 8f5f3786

include/net/netfilter/nf_tables.h

+2 −1
Original line number Diff line number Diff line
@@ -1463,7 +1463,8 @@ struct nft_flowtable { 
	struct nf_flowtable		data;

};



struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,

struct nft_flowtable *nft_flowtable_lookup(const struct net *net,

					   const struct nft_table *table,

					   const struct nlattr *nla,

					   u8 genmask);

net/netfilter/nf_tables_api.c

+9 −6
Original line number Diff line number Diff line
@@ -8378,12 +8378,14 @@ static const struct nla_policy nft_flowtable_policy[NFTA_FLOWTABLE_MAX + 1] = { 
	[NFTA_FLOWTABLE_FLAGS]		= { .type = NLA_U32 },

};



struct nft_flowtable *nft_flowtable_lookup(const struct nft_table *table,

struct nft_flowtable *nft_flowtable_lookup(const struct net *net,

					   const struct nft_table *table,

					   const struct nlattr *nla, u8 genmask)

{

	struct nft_flowtable *flowtable;



	list_for_each_entry_rcu(flowtable, &table->flowtables, list) {

	list_for_each_entry_rcu(flowtable, &table->flowtables, list,

				lockdep_commit_lock_is_held(net)) {

		if (!nla_strcmp(nla, flowtable->name) &&

		    nft_active_genmask(flowtable, genmask))

			return flowtable;
@@ -8739,7 +8741,7 @@ static int nf_tables_newflowtable(struct sk_buff *skb, 
		return PTR_ERR(table);

	}



	flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],

	flowtable = nft_flowtable_lookup(net, table, nla[NFTA_FLOWTABLE_NAME],

					 genmask);

	if (IS_ERR(flowtable)) {

		err = PTR_ERR(flowtable);
@@ -8933,7 +8935,7 @@ static int nf_tables_delflowtable(struct sk_buff *skb, 
		flowtable = nft_flowtable_lookup_byhandle(table, attr, genmask);

	} else {

		attr = nla[NFTA_FLOWTABLE_NAME];

		flowtable = nft_flowtable_lookup(table, attr, genmask);

		flowtable = nft_flowtable_lookup(net, table, attr, genmask);

	}



	if (IS_ERR(flowtable)) {
@@ -9003,7 +9005,8 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net, 
	if (!hook_list)

		hook_list = &flowtable->hook_list;



	list_for_each_entry_rcu(hook, hook_list, list) {

	list_for_each_entry_rcu(hook, hook_list, list,

				lockdep_commit_lock_is_held(net)) {

		if (nla_put_string(skb, NFTA_DEVICE_NAME, hook->ops.dev->name))

			goto nla_put_failure;

	}
@@ -9145,7 +9148,7 @@ static int nf_tables_getflowtable(struct sk_buff *skb, 
		return PTR_ERR(table);

	}



	flowtable = nft_flowtable_lookup(table, nla[NFTA_FLOWTABLE_NAME],

	flowtable = nft_flowtable_lookup(net, table, nla[NFTA_FLOWTABLE_NAME],

					 genmask);

	if (IS_ERR(flowtable)) {

		NL_SET_BAD_ATTR(extack, nla[NFTA_FLOWTABLE_NAME]);

net/netfilter/nft_flow_offload.c

+2 −2
Original line number Diff line number Diff line
@@ -409,8 +409,8 @@ static int nft_flow_offload_init(const struct nft_ctx *ctx, 
	if (!tb[NFTA_FLOW_TABLE_NAME])

		return -EINVAL;



	flowtable = nft_flowtable_lookup(ctx->table, tb[NFTA_FLOW_TABLE_NAME],

					 genmask);

	flowtable = nft_flowtable_lookup(ctx->net, ctx->table,

					 tb[NFTA_FLOW_TABLE_NAME], genmask);

	if (IS_ERR(flowtable))

		return PTR_ERR(flowtable);