nf_flow_offload_xdp_setup routine allocates/removes entries in
nf_xdp_hashtable hash running FLOW_BLOCK_BIND/FLOW_BLOCK_UNBIND
commands. In the current codebase we have an FLOW_BLOCK_BIND/
FLOW_BLOCK_UNBIND unbalance since we do not run FLOW_BLOCK_UNBIND in
__nft_unregister_flowtable_net_hooks() triggering the following error
reported by kmeamlak:
[<00000000be65a589>] __kmalloc_cache_noprof+0x280/0x310
[<00000000c6569ad4>] nf_flow_offload_xdp_setup+0x70/0x8d0 [nf_flow_table]
[<000000001efe6e35>] nf_flow_table_offload_setup+0x324/0x610 [nf_flow_table]
[<000000005d9c9ad6>] nft_register_flowtable_net_hooks+0x3f4/0x890 [nf_tables]
[<00000000de9071ee>] nf_tables_newflowtable+0xf61/0x18c0 [nf_tables]
[<00000000924f5d86>] nfnetlink_rcv_batch+0x12c1/0x1c50 [nfnetlink]
[<000000003fa07104>] nfnetlink_rcv+0x2a3/0x320 [nfnetlink]
[<000000009fd1c990>] netlink_unicast+0x588/0x7f0
[<00000000ee126795>] netlink_sendmsg+0x702/0xba0
[<000000000ddf29fb>] ____sys_sendmsg+0x7cd/0x9a0
[<0000000027b80416>] ___sys_sendmsg+0xd6/0x140
[<00000000edfe1eb5>] __sys_sendmsg+0xba/0x150
[<000000009d5eb571>] do_syscall_64+0x47/0x110
[<0000000077c3a21e>] entry_SYSCALL_64_after_hwframe+0x76/0x7e
Fix the issue running FLOW_BLOCK_UNBIND command in
__nft_unregister_flowtable_net_hooks() if the nft_hook is removed.
Fixes: 89cc8f1c5f22 ("netfilter: nf_tables: Add flowtable map for xdp offload")
Signed-off-by: Lorenzo Bianconi <lorenzo@xxxxxxxxxx>
---
net/netfilter/nf_tables_api.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index a24fe62650a753be872a2051b34ff0aba27ef8c4..53357b61700b01048e840154dffd55a2c05062c1 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -8546,14 +8546,18 @@ static void nft_unregister_flowtable_hook(struct net *net,
}
static void __nft_unregister_flowtable_net_hooks(struct net *net,
- struct list_head *hook_list,
- bool release_netdev)
+ struct nft_flowtable *flowtable,
+ struct list_head *hook_list)
{
struct nft_hook *hook, *next;
list_for_each_entry_safe(hook, next, hook_list, list) {
+ if (flowtable)
+ flowtable->data.type->setup(&flowtable->data,
+ hook->ops.dev,
+ FLOW_BLOCK_UNBIND);
nf_unregister_net_hook(net, &hook->ops);
- if (release_netdev) {
+ if (flowtable) {
list_del(&hook->list);
kfree_rcu(hook, rcu);
}
@@ -8563,7 +8567,7 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net,
static void nft_unregister_flowtable_net_hooks(struct net *net,
struct list_head *hook_list)
{
- __nft_unregister_flowtable_net_hooks(net, hook_list, false);
+ __nft_unregister_flowtable_net_hooks(net, NULL, hook_list);
}
static int nft_register_flowtable_net_hooks(struct net *net,
@@ -11459,8 +11463,8 @@ static void __nft_release_hook(struct net *net, struct nft_table *table)
list_for_each_entry(chain, &table->chains, list)
__nf_tables_unregister_hook(net, table, chain, true);
list_for_each_entry(flowtable, &table->flowtables, list)
- __nft_unregister_flowtable_net_hooks(net, &flowtable->hook_list,
- true);
+ __nft_unregister_flowtable_net_hooks(net, flowtable,
+ &flowtable->hook_list);
}
static void __nft_release_hooks(struct net *net)
---
base-commit: 1d227fcc72223cbdd34d0ce13541cbaab5e0d72f
change-id: 20241011-flowtable-xdp-memleak-05cdd4c22369
Best regards,
--
Lorenzo Bianconi <lorenzo@xxxxxxxxxx>
