Netfilter-Devel Archive on
 help / color / Atom feed
From: Pablo Neira Ayuso <>
Subject: [PATCH 5/9] netfilter: nf_tables: Align nft_expr private data to 64-bit
Date: Wed,  6 Nov 2019 12:12:33 +0100
Message-ID: <> (raw)
In-Reply-To: <>

From: Lukas Wunner <>

Invoking the following commands on a 32-bit architecture with strict
alignment requirements (such as an ARMv7-based Raspberry Pi) results
in an alignment exception:

 # nft add table ip test-ip4
 # nft add chain ip test-ip4 output { type filter hook output priority 0; }
 # nft add rule  ip test-ip4 output quota 1025 bytes

Alignment trap: not handling instruction e1b26f9f at [<7f4473f8>]
Unhandled fault: alignment exception (0x001) at 0xb832e824
Internal error: : 1 [#1] PREEMPT SMP ARM
Hardware name: BCM2835
[<7f4473fc>] (nft_quota_do_init [nft_quota])
[<7f447448>] (nft_quota_init [nft_quota])
[<7f4260d0>] (nf_tables_newrule [nf_tables])
[<7f4168dc>] (nfnetlink_rcv_batch [nfnetlink])
[<7f416bd0>] (nfnetlink_rcv [nfnetlink])
[<8078b334>] (netlink_unicast)
[<8078b664>] (netlink_sendmsg)
[<8071b47c>] (sock_sendmsg)
[<8071bd18>] (___sys_sendmsg)
[<8071ce3c>] (__sys_sendmsg)
[<8071ce94>] (sys_sendmsg)

The reason is that nft_quota_do_init() calls atomic64_set() on an
atomic64_t which is only aligned to 32-bit, not 64-bit, because it
succeeds struct nft_expr in memory which only contains a 32-bit pointer.
Fix by aligning the nft_expr private data to 64-bit.

Fixes: 96518518cc41 ("netfilter: add nftables")
Signed-off-by: Lukas Wunner <>
Cc: # v3.13+
Signed-off-by: Pablo Neira Ayuso <>
 include/net/netfilter/nf_tables.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 001d294edf57..2d0275f13bbf 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -820,7 +820,8 @@ struct nft_expr_ops {
 struct nft_expr {
 	const struct nft_expr_ops	*ops;
-	unsigned char			data[];
+	unsigned char			data[]
+		__attribute__((aligned(__alignof__(u64))));
 static inline void *nft_expr_priv(const struct nft_expr *expr)

  parent reply index

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-11-06 11:12 [PATCH 0/9] Netfilter fixes for net Pablo Neira Ayuso
2019-11-06 11:12 ` [PATCH 1/9] netfilter: nf_tables_offload: check for register data length mismatches Pablo Neira Ayuso
2019-11-06 11:12 ` [PATCH 2/9] netfilter: ipset: Fix an error code in ip_set_sockfn_get() Pablo Neira Ayuso
2019-11-06 11:12 ` [PATCH 3/9] netfilter: ipset: Copy the right MAC address in hash:ip,mac IPv6 sets Pablo Neira Ayuso
2019-11-06 11:12 ` [PATCH 4/9] netfilter: ipset: Fix nla_policies to fully support NL_VALIDATE_STRICT Pablo Neira Ayuso
2019-11-06 11:12 ` Pablo Neira Ayuso [this message]
2019-11-06 11:12 ` [PATCH 6/9] netfilter: nf_tables: fix unexpected EOPNOTSUPP error Pablo Neira Ayuso
2019-11-06 11:12 ` [PATCH 7/9] bridge: ebtables: don't crash when using dnat target in output chains Pablo Neira Ayuso
2019-11-06 11:12 ` [PATCH 8/9] netfilter: nf_tables: bogus EOPNOTSUPP on basechain update Pablo Neira Ayuso
2019-11-06 11:12 ` [PATCH 9/9] netfilter: nf_tables_offload: skip EBUSY on chain update Pablo Neira Ayuso
2019-11-07  5:17 ` [PATCH 0/9] Netfilter fixes for net David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Netfilter-Devel Archive on

Archives are clonable:
	git clone --mirror netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ \
	public-inbox-index netfilter-devel

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone