This is a note to let you know that I've just added the patch titled
netfilter: nf_tables: can't schedule in nft_chain_validate
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nf_tables-can-t-schedule-in-nft_chain_validate.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 314c82841602a111c04a7210c21dc77e0d560242 Mon Sep 17 00:00:00 2001
From: Florian Westphal <fw@xxxxxxxxx>
Date: Tue, 18 Jul 2023 01:30:33 +0200
Subject: netfilter: nf_tables: can't schedule in nft_chain_validate
From: Florian Westphal <fw@xxxxxxxxx>
commit 314c82841602a111c04a7210c21dc77e0d560242 upstream.
Can be called via nft set element list iteration, which may acquire
rcu and/or bh read lock (depends on set type).
BUG: sleeping function called from invalid context at net/netfilter/nf_tables_api.c:3353
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1232, name: nft
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
2 locks held by nft/1232:
#0: ffff8881180e3ea8 (&nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid
#1: ffffffff83f5f540 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire
Call Trace:
nft_chain_validate
nft_lookup_validate_setelem
nft_pipapo_walk
nft_lookup_validate
nft_chain_validate
nft_immediate_validate
nft_chain_validate
nf_tables_validate
nf_tables_abort
No choice but to move it to nf_tables_validate().
Fixes: 81ea01066741 ("netfilter: nf_tables: add rescheduling points during loop detection walks")
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/netfilter/nf_tables_api.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3443,8 +3443,6 @@ int nft_chain_validate(const struct nft_
if (err < 0)
return err;
}
-
- cond_resched();
}
return 0;
@@ -3468,6 +3466,8 @@ static int nft_table_validate(struct net
err = nft_chain_validate(&ctx, chain);
if (err < 0)
return err;
+
+ cond_resched();
}
return 0;
Patches currently in stable-queue which might be from fw@xxxxxxxxx are
queue-5.15/netfilter-nf_tables-add-rescheduling-points-during-l.patch
queue-5.15/perf-beauty-update-copy-of-linux-socket.h-with-the-k.patch
queue-5.15/netfilter-flowtable-simplify-route-logic.patch
queue-5.15/netfilter-nf_tables-can-t-schedule-in-nft_chain_validate.patch
queue-5.15/netfilter-nf_tables-fix-scheduling-while-atomic-splat.patch
queue-5.15/netfilter-nft_flow_offload-release-dst-in-case-direc.patch
queue-5.15/netfilter-nf_tables-set-dormant-flag-on-hook-registe.patch
