Netfilter-Devel Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH nf] netfilter: flowtable: set NF_FLOW_TEARDOWN flag on entry expiration
@ 2020-05-11 10:17 Pablo Neira Ayuso
  2020-05-11 10:40 ` Roi Dayan
  0 siblings, 1 reply; 2+ messages in thread
From: Pablo Neira Ayuso @ 2020-05-11 10:17 UTC (permalink / raw)
  To: netfilter-devel; +Cc: ozsh, roid, saeedm

If the flow timer expires, the gc sets on the NF_FLOW_TEARDOWN flag.
Otherwise, the flowtable software path might race to refresh the
timeout, leaving the state machine in inconsistent state.

Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
Reported-by: Paul Blakey <paulb@mellanox.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nf_flow_table_core.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 4344e572b7f9..42da6e337276 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -284,7 +284,7 @@ static void flow_offload_del(struct nf_flowtable *flow_table,
 
 	if (nf_flow_has_expired(flow))
 		flow_offload_fixup_ct(flow->ct);
-	else if (test_bit(NF_FLOW_TEARDOWN, &flow->flags))
+	else
 		flow_offload_fixup_ct_timeout(flow->ct);
 
 	flow_offload_free(flow);
@@ -361,8 +361,10 @@ static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data)
 {
 	struct nf_flowtable *flow_table = data;
 
-	if (nf_flow_has_expired(flow) || nf_ct_is_dying(flow->ct) ||
-	    test_bit(NF_FLOW_TEARDOWN, &flow->flags)) {
+	if (nf_flow_has_expired(flow) || nf_ct_is_dying(flow->ct))
+		set_bit(NF_FLOW_TEARDOWN, &flow->flags);
+
+	if (test_bit(NF_FLOW_TEARDOWN, &flow->flags)) {
 		if (test_bit(NF_FLOW_HW, &flow->flags)) {
 			if (!test_bit(NF_FLOW_HW_DYING, &flow->flags))
 				nf_flow_offload_del(flow_table, flow);
-- 
2.20.1


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH nf] netfilter: flowtable: set NF_FLOW_TEARDOWN flag on entry expiration
  2020-05-11 10:17 [PATCH nf] netfilter: flowtable: set NF_FLOW_TEARDOWN flag on entry expiration Pablo Neira Ayuso
@ 2020-05-11 10:40 ` Roi Dayan
  0 siblings, 0 replies; 2+ messages in thread
From: Roi Dayan @ 2020-05-11 10:40 UTC (permalink / raw)
  To: Pablo Neira Ayuso, netfilter-devel; +Cc: ozsh, saeedm



On 2020-05-11 1:17 PM, Pablo Neira Ayuso wrote:
> If the flow timer expires, the gc sets on the NF_FLOW_TEARDOWN flag.
> Otherwise, the flowtable software path might race to refresh the
> timeout, leaving the state machine in inconsistent state.
> 
> Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
> Reported-by: Paul Blakey <paulb@mellanox.com>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
>  net/netfilter/nf_flow_table_core.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
> index 4344e572b7f9..42da6e337276 100644
> --- a/net/netfilter/nf_flow_table_core.c
> +++ b/net/netfilter/nf_flow_table_core.c
> @@ -284,7 +284,7 @@ static void flow_offload_del(struct nf_flowtable *flow_table,
>  
>  	if (nf_flow_has_expired(flow))
>  		flow_offload_fixup_ct(flow->ct);
> -	else if (test_bit(NF_FLOW_TEARDOWN, &flow->flags))
> +	else
>  		flow_offload_fixup_ct_timeout(flow->ct);
>  
>  	flow_offload_free(flow);
> @@ -361,8 +361,10 @@ static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data)
>  {
>  	struct nf_flowtable *flow_table = data;
>  
> -	if (nf_flow_has_expired(flow) || nf_ct_is_dying(flow->ct) ||
> -	    test_bit(NF_FLOW_TEARDOWN, &flow->flags)) {
> +	if (nf_flow_has_expired(flow) || nf_ct_is_dying(flow->ct))
> +		set_bit(NF_FLOW_TEARDOWN, &flow->flags);
> +
> +	if (test_bit(NF_FLOW_TEARDOWN, &flow->flags)) {
>  		if (test_bit(NF_FLOW_HW, &flow->flags)) {
>  			if (!test_bit(NF_FLOW_HW_DYING, &flow->flags))
>  				nf_flow_offload_del(flow_table, flow);
> 

thanks

Reviewed-by: Roi Dayan <roid@mellanox.com>

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-11 10:17 [PATCH nf] netfilter: flowtable: set NF_FLOW_TEARDOWN flag on entry expiration Pablo Neira Ayuso
2020-05-11 10:40 ` Roi Dayan

Netfilter-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netfilter-devel/0 netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ https://lore.kernel.org/netfilter-devel \
		netfilter-devel@vger.kernel.org
	public-inbox-index netfilter-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netfilter-devel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git