Commit b326dd37 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso

netfilter: nf_tables: restore synchronous object release from commit/abort

The existing xtables matches and targets, when used from nft_compat, may
sleep from the destroy path, ie. when removing rules. Since the objects
are released via call_rcu from softirq context, this results in lockdep
splats and possible lockups that may be hard to reproduce.

Patrick also indicated that delayed object release via call_rcu can
cause us problems in the ordering of event notifications when anonymous
sets are in place.

So, this patch restores the synchronous object release from the commit
and abort paths. This includes a call to synchronize_rcu() to make sure
that no packets are walking on the objects that are going to be
released. This is slowier though, but it's simple and it resolves the
aforementioned problems.

This is a partial revert of c7c32e72 ("netfilter: nf_tables: defer all
object release via rcu") that was introduced in 3.16 to speed up
interaction with userspace.
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent afefb6f9
...@@ -396,14 +396,12 @@ struct nft_rule { ...@@ -396,14 +396,12 @@ struct nft_rule {
/** /**
* struct nft_trans - nf_tables object update in transaction * struct nft_trans - nf_tables object update in transaction
* *
* @rcu_head: rcu head to defer release of transaction data
* @list: used internally * @list: used internally
* @msg_type: message type * @msg_type: message type
* @ctx: transaction context * @ctx: transaction context
* @data: internal information related to the transaction * @data: internal information related to the transaction
*/ */
struct nft_trans { struct nft_trans {
struct rcu_head rcu_head;
struct list_head list; struct list_head list;
int msg_type; int msg_type;
struct nft_ctx ctx; struct nft_ctx ctx;
......
...@@ -3484,13 +3484,8 @@ static void nft_chain_commit_update(struct nft_trans *trans) ...@@ -3484,13 +3484,8 @@ static void nft_chain_commit_update(struct nft_trans *trans)
} }
} }
/* Schedule objects for release via rcu to make sure no packets are accesing static void nf_tables_commit_release(struct nft_trans *trans)
* removed rules.
*/
static void nf_tables_commit_release_rcu(struct rcu_head *rt)
{ {
struct nft_trans *trans = container_of(rt, struct nft_trans, rcu_head);
switch (trans->msg_type) { switch (trans->msg_type) {
case NFT_MSG_DELTABLE: case NFT_MSG_DELTABLE:
nf_tables_table_destroy(&trans->ctx); nf_tables_table_destroy(&trans->ctx);
...@@ -3612,10 +3607,11 @@ static int nf_tables_commit(struct sk_buff *skb) ...@@ -3612,10 +3607,11 @@ static int nf_tables_commit(struct sk_buff *skb)
} }
} }
synchronize_rcu();
list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) { list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
list_del(&trans->list); list_del(&trans->list);
trans->ctx.nla = NULL; nf_tables_commit_release(trans);
call_rcu(&trans->rcu_head, nf_tables_commit_release_rcu);
} }
nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN); nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
...@@ -3623,13 +3619,8 @@ static int nf_tables_commit(struct sk_buff *skb) ...@@ -3623,13 +3619,8 @@ static int nf_tables_commit(struct sk_buff *skb)
return 0; return 0;
} }
/* Schedule objects for release via rcu to make sure no packets are accesing static void nf_tables_abort_release(struct nft_trans *trans)
* aborted rules.
*/
static void nf_tables_abort_release_rcu(struct rcu_head *rt)
{ {
struct nft_trans *trans = container_of(rt, struct nft_trans, rcu_head);
switch (trans->msg_type) { switch (trans->msg_type) {
case NFT_MSG_NEWTABLE: case NFT_MSG_NEWTABLE:
nf_tables_table_destroy(&trans->ctx); nf_tables_table_destroy(&trans->ctx);
...@@ -3725,11 +3716,12 @@ static int nf_tables_abort(struct sk_buff *skb) ...@@ -3725,11 +3716,12 @@ static int nf_tables_abort(struct sk_buff *skb)
} }
} }
synchronize_rcu();
list_for_each_entry_safe_reverse(trans, next, list_for_each_entry_safe_reverse(trans, next,
&net->nft.commit_list, list) { &net->nft.commit_list, list) {
list_del(&trans->list); list_del(&trans->list);
trans->ctx.nla = NULL; nf_tables_abort_release(trans);
call_rcu(&trans->rcu_head, nf_tables_abort_release_rcu);
} }
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment