From: Florian Westphal <fw@strlen.de>
To: <netdev@vger.kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>,
<netfilter-devel@vger.kernel.org>
Subject: [PATCH net 1/9] netfilter: nf_tables: fix false-positive lockdep splat
Date: Wed, 16 Aug 2023 00:29:51 +0200 [thread overview]
Message-ID: <20230815223011.7019-2-fw@strlen.de> (raw)
In-Reply-To: <20230815223011.7019-1-fw@strlen.de>
->abort invocation may cause splat on debug kernels:
WARNING: suspicious RCU usage
net/netfilter/nft_set_pipapo.c:1697 suspicious rcu_dereference_check() usage!
[..]
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by nft/133554: [..] (nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid
[..]
lockdep_rcu_suspicious+0x1ad/0x260
nft_pipapo_abort+0x145/0x180
__nf_tables_abort+0x5359/0x63d0
nf_tables_abort+0x24/0x40
nfnetlink_rcv+0x1a0a/0x22c0
netlink_unicast+0x73c/0x900
netlink_sendmsg+0x7f0/0xc20
____sys_sendmsg+0x48d/0x760
Transaction mutex is held, so parallel updates are not possible.
Switch to _protected and check mutex is held for lockdep enabled builds.
Fixes: 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol")
Signed-off-by: Florian Westphal <fw@strlen.de>
---
net/netfilter/nft_set_pipapo.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
index a5b8301afe4a..5fa12cfc7b84 100644
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -1697,6 +1697,17 @@ static void nft_pipapo_commit(const struct nft_set *set)
priv->clone = new_clone;
}
+static bool nft_pipapo_transaction_mutex_held(const struct nft_set *set)
+{
+#ifdef CONFIG_PROVE_LOCKING
+ const struct net *net = read_pnet(&set->net);
+
+ return lockdep_is_held(&nft_pernet(net)->commit_mutex);
+#else
+ return true;
+#endif
+}
+
static void nft_pipapo_abort(const struct nft_set *set)
{
struct nft_pipapo *priv = nft_set_priv(set);
@@ -1705,7 +1716,7 @@ static void nft_pipapo_abort(const struct nft_set *set)
if (!priv->dirty)
return;
- m = rcu_dereference(priv->match);
+ m = rcu_dereference_protected(priv->match, nft_pipapo_transaction_mutex_held(set));
new_clone = pipapo_clone(m);
if (IS_ERR(new_clone))
--
2.41.0
next prev parent reply other threads:[~2023-08-15 22:30 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-15 22:29 [PATCH net 0/9] netfilter fixes for net Florian Westphal
2023-08-15 22:29 ` Florian Westphal [this message]
2023-08-16 10:20 ` [PATCH net 1/9] netfilter: nf_tables: fix false-positive lockdep splat patchwork-bot+netdevbpf
2023-08-15 22:29 ` [PATCH net 2/9] netfilter: nf_tables: fix kdoc warnings after gc rework Florian Westphal
2023-08-15 22:29 ` [PATCH net 3/9] netfilter: nf_tables: deactivate catchall elements in next generation Florian Westphal
2023-08-15 22:29 ` [PATCH net 4/9] netfilter: nf_tables: don't fail inserts if duplicate has expired Florian Westphal
2023-08-15 22:29 ` [PATCH net 5/9] netfilter: set default timeout to 3 secs for sctp shutdown send and recv state Florian Westphal
2023-08-15 22:29 ` [PATCH net 6/9] ipvs: fix racy memcpy in proc_do_sync_threshold Florian Westphal
2023-08-15 22:29 ` [PATCH net 7/9] netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path Florian Westphal
2023-08-15 22:29 ` [PATCH net 8/9] netfilter: nf_tables: GC transaction race with netns dismantle Florian Westphal
2023-08-15 22:29 ` [PATCH net 9/9] netfilter: nft_dynset: disallow object maps Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230815223011.7019-2-fw@strlen.de \
--to=fw@strlen.de \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).