Patch "netfilter: nf_tables: can't schedule in nft_chain_validate" has been added to the 5.10-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    netfilter: nf_tables: can't schedule in nft_chain_validate

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-nf_tables-can-t-schedule-in-nft_chain_vali.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 5103fefc2d79d684a4a836a73788f1a9d0f3ad70
Author: Florian Westphal <fw@xxxxxxxxx>
Date:   Tue Jul 18 01:30:33 2023 +0200

    netfilter: nf_tables: can't schedule in nft_chain_validate
    
    [ Upstream commit 314c82841602a111c04a7210c21dc77e0d560242 ]
    
    Can be called via nft set element list iteration, which may acquire
    rcu and/or bh read lock (depends on set type).
    
    BUG: sleeping function called from invalid context at net/netfilter/nf_tables_api.c:3353
    in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1232, name: nft
    preempt_count: 0, expected: 0
    RCU nest depth: 1, expected: 0
    2 locks held by nft/1232:
     #0: ffff8881180e3ea8 (&nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid
     #1: ffffffff83f5f540 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire
    Call Trace:
     nft_chain_validate
     nft_lookup_validate_setelem
     nft_pipapo_walk
     nft_lookup_validate
     nft_chain_validate
     nft_immediate_validate
     nft_chain_validate
     nf_tables_validate
     nf_tables_abort
    
    No choice but to move it to nf_tables_validate().
    
    Fixes: 81ea01066741 ("netfilter: nf_tables: add rescheduling points during loop detection walks")
    Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 9c3a9e3f1ede9..a8d316a58e44c 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3276,8 +3276,6 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
 			if (err < 0)
 				return err;
 		}
-
-		cond_resched();
 	}
 
 	return 0;
@@ -3301,6 +3299,8 @@ static int nft_table_validate(struct net *net, const struct nft_table *table)
 		err = nft_chain_validate(&ctx, chain);
 		if (err < 0)
 			return err;
+
+		cond_resched();
 	}
 
 	return 0;



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux