| Message ID | 20241030094053.13118-8-fw@strlen.de |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | netfilter: nf_tables: avoid PROVE_RCU_LIST splats | expand |
Hi Florian, kernel test robot noticed the following build warnings: https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Florian-Westphal/netfilter-nf_tables-avoid-false-positive-lockdep-splat-on-rule-deletion/20241030-174657 base: https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git main patch link: https://lore.kernel.org/r/20241030094053.13118-8-fw%40strlen.de patch subject: [PATCH v2 nf-next 7/7] netfilter: nf_tables: must hold rcu read lock while iterating object type list config: s390-randconfig-r073-20241031 (https://download.01.org/0day-ci/archive/20241101/202411010754.SLk5GvT6-lkp@intel.com/config) compiler: s390-linux-gcc (GCC) 14.1.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> | Reported-by: Dan Carpenter <dan.carpenter@linaro.org> | Closes: https://lore.kernel.org/r/202411010754.SLk5GvT6-lkp@intel.com/ New smatch warnings: net/netfilter/nf_tables_api.c:7886 nf_tables_newobj() warn: 'type' is an error pointer or valid vim +/type +7886 net/netfilter/nf_tables_api.c 7dab8ee3b6e7ec8 Pablo Neira Ayuso 2021-04-23 7879 if (info->nlh->nlmsg_flags & NLM_F_REPLACE) d62d0ba97b58031 Fernando Fernandez Mancera 2019-08-26 7880 return -EOPNOTSUPP; d62d0ba97b58031 Fernando Fernandez Mancera 2019-08-26 7881 84b1a0c0140a9a9 Pablo Neira Ayuso 2024-03-05 7882 if (!obj->ops->update) 84b1a0c0140a9a9 Pablo Neira Ayuso 2024-03-05 7883 return 0; 84b1a0c0140a9a9 Pablo Neira Ayuso 2024-03-05 7884 2a7dbf052c3b79b Florian Westphal 2024-10-30 7885 type = nft_obj_type_get(net, objtype, family); 2a7dbf052c3b79b Florian Westphal 2024-10-30 @7886 if (WARN_ON_ONCE(!type)) s/!type/IS_ERR(type)/ 2a7dbf052c3b79b Florian Westphal 2024-10-30 7887 return -ENOENT; 2a7dbf052c3b79b Florian Westphal 2024-10-30 7888 7dab8ee3b6e7ec8 Pablo Neira Ayuso 2021-04-23 7889 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); d62d0ba97b58031 Fernando Fernandez Mancera 2019-08-26 7890 2a7dbf052c3b79b Florian Westphal 2024-10-30 7891 /* type->owner reference is put when transaction object is released. */ d62d0ba97b58031 Fernando Fernandez Mancera 2019-08-26 7892 return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj); e50092404c1bc7a Pablo Neira Ayuso 2016-11-28 7893 } e50092404c1bc7a Pablo Neira Ayuso 2016-11-28 7894 7dab8ee3b6e7ec8 Pablo Neira Ayuso 2021-04-23 7895 nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); e50092404c1bc7a Pablo Neira Ayuso 2016-11-28 7896 1689f25924ada8f Pablo Neira Ayuso 2023-06-28 7897 if (!nft_use_inc(&table->use)) 1689f25924ada8f Pablo Neira Ayuso 2023-06-28 7898 return -EMFILE;
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index c588cab98260..1583d50c65b7 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -7809,9 +7809,7 @@ static int nf_tables_updobj(const struct nft_ctx *ctx, struct nft_trans *trans; int err = -ENOMEM; - if (!try_module_get(type->owner)) - return -ENOENT; - + /* caller must have obtained type->owner reference. */ trans = nft_trans_alloc(ctx, NFT_MSG_NEWOBJ, sizeof(struct nft_trans_obj)); if (!trans) @@ -7879,15 +7877,16 @@ static int nf_tables_newobj(struct sk_buff *skb, const struct nfnl_info *info, if (info->nlh->nlmsg_flags & NLM_F_REPLACE) return -EOPNOTSUPP; - type = __nft_obj_type_get(objtype, family); - if (WARN_ON_ONCE(!type)) - return -ENOENT; - if (!obj->ops->update) return 0; + type = nft_obj_type_get(net, objtype, family); + if (WARN_ON_ONCE(!type)) + return -ENOENT; + nft_ctx_init(&ctx, net, skb, info->nlh, family, table, NULL, nla); + /* type->owner reference is put when transaction object is released. */ return nf_tables_updobj(&ctx, type, nla[NFTA_OBJ_DATA], obj); }
Update of stateful object triggers: WARNING: suspicious RCU usage net/netfilter/nf_tables_api.c:7759 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by nft/3060: #0: ffff88810f0578c8 (&nft_net->commit_mutex){+.+.}-{4:4}, [..] ... but this list is not protected by the transaction mutex but the nfnl nftables subsystem mutex. Switch to nft_obj_type_get which will acquire rcu read lock, bump refcount, and returns the result. Fixes: dad3bdeef45f ("netfilter: nf_tables: fix memory leak during stateful obj update"). Signed-off-by: Florian Westphal <fw@strlen.de> --- net/netfilter/nf_tables_api.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)