On Tue, Jun 27, 2023 at 01:12:48PM +0200, Florian Westphal wrote:
> Daniel Xu <dxu@xxxxxxxxx> wrote:
> > +static int bpf_nf_enable_defrag(struct bpf_nf_link *link)
> > +{
> > + int err;
> > +
> > + switch (link->hook_ops.pf) {
> > +#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
> > + case NFPROTO_IPV4:
> > + const struct nf_defrag_v4_hook *v4_hook;
> > +
> > + err = request_module("nf_defrag_ipv4");
> > + if (err)
> > + return err;
> > +
> > + rcu_read_lock();
> > + v4_hook = rcu_dereference(nf_defrag_v4_hook);
> > + err = v4_hook->enable(link->net);
> > + rcu_read_unlock();
>
> I'd reverse this, first try rcu_dereference(), then modprobe
> if thats returned NULL.
Ack.
>
> > +static void bpf_nf_disable_defrag(struct bpf_nf_link *link)
> > +{
> > + switch (link->hook_ops.pf) {
> > +#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
> > + case NFPROTO_IPV4:
> > + const struct nf_defrag_v4_hook *v4_hook;
> > +
> > + rcu_read_lock();
> > + v4_hook = rcu_dereference(nf_defrag_v4_hook);
> > + v4_hook->disable(link->net);
> > + rcu_read_unlock();
>
> if (v4_hook)
> v4_hook->disable()
>
> Else we get trouble on manual 'rmmod'.
Ah good catch, thanks.
>
> > + /* make sure conntrack confirm is always last */
> > + prio = attr->link_create.netfilter.priority;
> > + if (prio == NF_IP_PRI_FIRST)
> > + return -ERANGE; /* sabotage_in and other warts */
> > + else if (prio == NF_IP_PRI_LAST)
> > + return -ERANGE; /* e.g. conntrack confirm */
> > + else if ((attr->link_create.netfilter.flags & BPF_F_NETFILTER_IP_DEFRAG) &&
> > + (prio > NF_IP_PRI_FIRST && prio <= NF_IP_PRI_CONNTRACK_DEFRAG))
> > + return -ERANGE; /* cannot use defrag if prog runs before nf_defrag */
>
> You could elide the (prio > NF_IP_PRI_FIRST, its already handled by
> first conditional. Otherwise this looks good to me.
>
Ah, right. It's INT_MIN.
Thanks,
Daniel
