This is a note to let you know that I've just added the patch titled
netfilter: nf_tables: fix false-positive lockdep splat
to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nf_tables-fix-false-positive-lockdep-splat.patch
and it can be found in the queue-5.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From b9f052dc68f69dac89fe1e24693354c033daa091 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@xxxxxxxxx>
Date: Tue, 8 Aug 2023 20:40:17 +0200
Subject: netfilter: nf_tables: fix false-positive lockdep splat
From: Florian Westphal <fw@xxxxxxxxx>
commit b9f052dc68f69dac89fe1e24693354c033daa091 upstream.
->abort invocation may cause splat on debug kernels:
WARNING: suspicious RCU usage
net/netfilter/nft_set_pipapo.c:1697 suspicious rcu_dereference_check() usage!
[..]
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by nft/133554: [..] (nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid
[..]
lockdep_rcu_suspicious+0x1ad/0x260
nft_pipapo_abort+0x145/0x180
__nf_tables_abort+0x5359/0x63d0
nf_tables_abort+0x24/0x40
nfnetlink_rcv+0x1a0a/0x22c0
netlink_unicast+0x73c/0x900
netlink_sendmsg+0x7f0/0xc20
____sys_sendmsg+0x48d/0x760
Transaction mutex is held, so parallel updates are not possible.
Switch to _protected and check mutex is held for lockdep enabled builds.
Fixes: 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol")
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/netfilter/nft_set_pipapo.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -1695,6 +1695,17 @@ static void nft_pipapo_commit(const stru
priv->clone = new_clone;
}
+static bool nft_pipapo_transaction_mutex_held(const struct nft_set *set)
+{
+#ifdef CONFIG_PROVE_LOCKING
+ const struct net *net = read_pnet(&set->net);
+
+ return lockdep_is_held(&nft_pernet(net)->commit_mutex);
+#else
+ return true;
+#endif
+}
+
static void nft_pipapo_abort(const struct nft_set *set)
{
struct nft_pipapo *priv = nft_set_priv(set);
@@ -1703,7 +1714,7 @@ static void nft_pipapo_abort(const struc
if (!priv->dirty)
return;
- m = rcu_dereference(priv->match);
+ m = rcu_dereference_protected(priv->match, nft_pipapo_transaction_mutex_held(set));
new_clone = pipapo_clone(m);
if (IS_ERR(new_clone))
Patches currently in stable-queue which might be from fw@xxxxxxxxx are
queue-5.10/netfilter-nf_tables-defer-gc-run-if-previous-batch-i.patch
queue-5.10/netfilter-ipset-fix-race-between-ipset_cmd_create-an.patch
queue-5.10/netfilter-nf_tables-fix-kdoc-warnings-after-gc-rework.patch
queue-5.10/netfilter-exthdr-add-support-for-tcp-option-removal.patch
queue-5.10/netfilter-nft_exthdr-fix-for-unsafe-packet-data-read.patch
queue-5.10/netfilter-nft_set_rbtree-skip-sync-gc-for-new-elemen.patch
queue-5.10/netfilter-nf_tables-add-and-use-nft_sk-helper.patch
queue-5.10/netfilter-nf_tables-fix-false-positive-lockdep-splat.patch
queue-5.10/netfilter-nf_tables-gc-transaction-race-with-netns-d.patch
queue-5.10/netfilter-nf_tables-don-t-fail-inserts-if-duplicate-.patch
queue-5.10/netfilter-nf_tables-add-and-use-nft_thoff-helper.patch
queue-5.10/netfilter-handle-the-connecting-collision-properly-i.patch
queue-5.10/netfilter-nf_tables-nft_set_rbtree-fix-spurious-inse.patch
queue-5.10/netfilter-nf_tables-fix-memleak-when-more-than-255-e.patch
queue-5.10/netfilter-nf_tables-don-t-skip-expired-elements-duri.patch
queue-5.10/netfilter-nf_tables-fix-gc-transaction-races-with-ne.patch
queue-5.10/netfilter-nftables-exthdr-fix-4-byte-stack-oob-write.patch
