This is a note to let you know that I've just added the patch titled
netfilter: nf_tables: defer gc run if previous batch is still pending
to the 5.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nf_tables-defer-gc-run-if-previous-batch-is-still-pending.patch
and it can be found in the queue-5.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From stable-owner@xxxxxxxxxxxxxxx Tue Nov 21 12:13:56 2023
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date: Tue, 21 Nov 2023 13:13:23 +0100
Subject: netfilter: nf_tables: defer gc run if previous batch is still pending
To: netfilter-devel@xxxxxxxxxxxxxxx
Cc: gregkh@xxxxxxxxxxxxxxxxxxx, sashal@xxxxxxxxxx, stable@xxxxxxxxxxxxxxx
Message-ID: <20231121121333.294238-17-pablo@xxxxxxxxxxxxx>
From: Florian Westphal <fw@xxxxxxxxx>
commit 8e51830e29e12670b4c10df070a4ea4c9593e961 upstream.
Don't queue more gc work, else we may queue the same elements multiple
times.
If an element is flagged as dead, this can mean that either the previous
gc request was invalidated/discarded by a transaction or that the previous
request is still pending in the system work queue.
The latter will happen if the gc interval is set to a very low value,
e.g. 1ms, and system work queue is backlogged.
The sets refcount is 1 if no previous gc requeusts are queued, so add
a helper for this and skip gc run if old requests are pending.
Add a helper for this and skip the gc run in this case.
Fixes: f6c383b8c31a ("netfilter: nf_tables: adapt set backend to use GC transaction API")
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
include/net/netfilter/nf_tables.h | 5 +++++
net/netfilter/nft_set_hash.c | 3 +++
net/netfilter/nft_set_rbtree.c | 3 +++
3 files changed, 11 insertions(+)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -467,6 +467,11 @@ static inline void *nft_set_priv(const s
return (void *)set->data;
}
+static inline bool nft_set_gc_is_pending(const struct nft_set *s)
+{
+ return refcount_read(&s->refs) != 1;
+}
+
static inline struct nft_set *nft_set_container_of(const void *priv)
{
return (void *)priv - offsetof(struct nft_set, data);
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -312,6 +312,9 @@ static void nft_rhash_gc(struct work_str
nft_net = net_generic(net, nf_tables_net_id);
gc_seq = READ_ONCE(nft_net->gc_seq);
+ if (nft_set_gc_is_pending(set))
+ goto done;
+
gc = nft_trans_gc_alloc(set, gc_seq, GFP_KERNEL);
if (!gc)
goto done;
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -615,6 +615,9 @@ static void nft_rbtree_gc(struct work_st
nft_net = net_generic(net, nf_tables_net_id);
gc_seq = READ_ONCE(nft_net->gc_seq);
+ if (nft_set_gc_is_pending(set))
+ goto done;
+
gc = nft_trans_gc_alloc(set, gc_seq, GFP_KERNEL);
if (!gc)
goto done;
Patches currently in stable-queue which might be from stable-owner@xxxxxxxxxxxxxxx are
queue-5.4/netfilter-nf_tables-fix-memleak-when-more-than-255-elements-expired.patch
queue-5.4/netfilter-nft_set_rbtree-fix-overlap-expiration-walk.patch
queue-5.4/netfilter-nf_tables-use-correct-lock-to-protect-gc_list.patch
queue-5.4/netfilter-nf_tables-disable-toggling-dormant-table-state-more-than-once.patch
queue-5.4/netfilter-nf_tables-gc-transaction-race-with-netns-dismantle.patch
queue-5.4/netfilter-nf_tables-drop-map-element-references-from-preparation-phase.patch
queue-5.4/netfilter-nf_tables-fix-gc-transaction-races-with-netns-and-netlink-event-exit-path.patch
queue-5.4/netfilter-nf_tables-don-t-skip-expired-elements-during-walk.patch
queue-5.4/netfilter-nf_tables-remove-busy-mark-and-gc-batch-api.patch
queue-5.4/netfilter-nf_tables-gc-transaction-race-with-abort-path.patch
queue-5.4/netfilter-nf_tables-unregister-flowtable-hooks-on-netns-exit.patch
queue-5.4/netfilter-nft_set_rbtree-switch-to-node-list-walk-for-overlap-detection.patch
queue-5.4/netfilter-nf_tables-adapt-set-backend-to-use-gc-transaction-api.patch
queue-5.4/netfilter-nftables-rename-set-element-data-activation-deactivation-functions.patch
queue-5.4/netfilter-nft_set_rbtree-skip-sync-gc-for-new-elements-in-this-transaction.patch
queue-5.4/netfilter-nf_tables-pass-context-to-nft_set_destroy.patch
queue-5.4/netfilter-nf_tables-bogus-ebusy-when-deleting-flowtable-after-flush-for-5.4.patch
queue-5.4/netfilter-nft_set_hash-try-later-when-gc-hits-eagain-on-iteration.patch
queue-5.4/netfilter-nf_tables-defer-gc-run-if-previous-batch-is-still-pending.patch
queue-5.4/netfilter-nft_set_rbtree-use-read-spinlock-to-avoid-datapath-contention.patch
queue-5.4/netfilter-nf_tables-double-hook-unregistration-in-netns-path.patch
queue-5.4/netfilter-nftables-update-table-flags-from-the-commit-phase.patch
queue-5.4/netfilter-nft_set_hash-mark-set-element-as-dead-when-deleting-from-packet-path.patch
queue-5.4/netfilter-nf_tables-gc-transaction-api-to-avoid-race-with-control-plane.patch
queue-5.4/netfilter-nf_tables-fix-table-flag-updates.patch
queue-5.4/netfilter-nft_set_rbtree-fix-null-deref-on-element-insertion.patch
