Hi,
The following patchset contains Netfilter fixes for net.
The existing attempt to resolve races between control plane and GC work
is error prone, as reported by Bien Pham <phamnnb@xxxxxxx>, some places
forgot to call nft_set_elem_mark_busy(), leading to double-deactivation
of elements.
This series contains the following patches:
1) Do not skip expired elements during walk otherwise elements might
never decrement the reference counter on data, leading to memleak.
2) Add a GC transaction API to replace the former attempt to deal with
races between control plane and GC. GC worker sets on NFT_SET_ELEM_DEAD_BIT
on elements and it creates a GC transaction to remove the expired
elements, GC transaction could abort in case of interference with
control plane and retried later (GC async). Set backends such as
rbtree and pipapo also perform GC from control plane (GC sync), in
such case, element deactivation and removal is safe because mutex
is held then collected elements are released via call_rcu().
3) Adapt existing set backends to use the GC transaction API.
4) Update rhash set backend to set on _DEAD bit to report deleted
elements from datapath for GC.
5) Remove old GC batch API and the NFT_SET_ELEM_BUSY_BIT.
Florian Westphal (1):
netfilter: nf_tables: don't skip expired elements during walk
Pablo Neira Ayuso (4):
netfilter: nf_tables: GC transaction API to avoid race with control plane
netfilter: nf_tables: adapt set backend to use GC transaction API
netfilter: nft_set_hash: mark set element as dead when deleting from packet path
netfilter: nf_tables: remove busy mark and gc batch API
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-23-08-10
Thanks.
----------------------------------------------------------------
The following changes since commit c5ccff70501d92db445a135fa49cf9bc6b98c444:
Merge branch 'net-sched-bind-logic-fixes-for-cls_fw-cls_u32-and-cls_route' (2023-07-31 20:10:39 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-23-08-10
for you to fetch changes up to a2dd0233cbc4d8a0abb5f64487487ffc9265beb5:
netfilter: nf_tables: remove busy mark and gc batch API (2023-08-10 08:25:27 +0200)
----------------------------------------------------------------
netfilter pull request 23-08-10
----------------------------------------------------------------
Florian Westphal (1):
netfilter: nf_tables: don't skip expired elements during walk
Pablo Neira Ayuso (4):
netfilter: nf_tables: GC transaction API to avoid race with control plane
netfilter: nf_tables: adapt set backend to use GC transaction API
netfilter: nft_set_hash: mark set element as dead when deleting from packet path
netfilter: nf_tables: remove busy mark and gc batch API
include/net/netfilter/nf_tables.h | 120 ++++++---------
net/netfilter/nf_tables_api.c | 307 ++++++++++++++++++++++++++++++--------
net/netfilter/nft_set_hash.c | 85 +++++++----
net/netfilter/nft_set_pipapo.c | 66 +++++---
net/netfilter/nft_set_rbtree.c | 146 ++++++++++--------
5 files changed, 476 insertions(+), 248 deletions(-)
