Re: [nf PATCH 2/5] netfilter: nf_tables: Add locking for NFT_MSG_GETRULE_RESET requests

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Mon, Sep 25, 2023 at 09:53:17PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote:
> > On Sat, Sep 23, 2023 at 06:18:13PM +0200, Florian Westphal wrote:
> > > callback_that_might_reset()
> > > {
> > > 	try_module_get ...
> > > 	rcu_read_unlock()
> > > 	mutex_lock(net->commit_mutex)
> > > 	  dumper();
> > > 	mutex_unlock(net->commit_mutex)
> > > 	rcu_read_lock();
> > > 	module_put()
> > > }
> > >
> > > should do the trick.
> > 
> > Idiom above LGTM, *except for net->commit_mutex*. Please do not use
> > ->commit_mutex: This will stall ruleset updates for no reason, netlink
> > dump would grab and release such mutex for each netlink_recvmsg() call
> > and netlink dump side will always retry because of NLM_F_EINTR.
> 
> It will stall updates, but for good reason: we are making changes to the
> expressions state.

This also disqualifies the use of Pablo's suggested reset_lock, right?

Cheers, Phil



[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux