No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Florian Westphal 5146c27b27 netfilter: nf_tables: do not defer rule destruction via call_rcu
commit b04df3da1b5c6f6dc7cdccc37941740c078c4043 upstream.

nf_tables_chain_destroy can sleep, it can't be used from call_rcu
callbacks.

Moreover, nf_tables_rule_release() is only safe for error unwinding,
while transaction mutex is held and the to-be-desroyed rule was not
exposed to either dataplane or dumps, as it deactives+frees without
the required synchronize_rcu() in-between.

nft_rule_expr_deactivate() callbacks will change ->use counters
of other chains/sets, see e.g. nft_lookup .deactivate callback, these
must be serialized via transaction mutex.

Also add a few lockdep asserts to make this more explicit.

Calling synchronize_rcu() isn't ideal, but fixing this without is hard
and way more intrusive.  As-is, we can get:

WARNING: .. net/netfilter/nf_tables_api.c:5515 nft_set_destroy+0x..
Workqueue: events nf_tables_trans_destroy_work
RIP: 0010:nft_set_destroy+0x3fe/0x5c0
Call Trace:
 <TASK>
 nf_tables_trans_destroy_work+0x6b7/0xad0
 process_one_work+0x64a/0xce0
 worker_thread+0x613/0x10d0

In case the synchronize_rcu becomes an issue, we can explore alternatives.

One way would be to allocate nft_trans_rule objects + one nft_trans_chain
object, deactivate the rules + the chain and then defer the freeing to the
nft destroy workqueue.  We'd still need to keep the synchronize_rcu path as
a fallback to handle -ENOMEM corner cases though.

Reported-by: syzbot+b26935466701e56cfdc2@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/67478d92.050a0220.253251.0062.GAE@google.com/T/
Fixes: c03d278fdf35 ("netfilter: nf_tables: wait for rcu grace period on net_device removal")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-06-04 14:32:36 +02:00
arch MIPS: pm-cps: Use per-CPU variables as per-CPU, not per-core 2025-06-04 14:32:33 +02:00
block block: fix 'kmem_cache of name 'bio-108' already exists' 2025-04-10 14:29:37 +02:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:11:22 +02:00
crypto crypto: algif_hash - fix double free in hash_accept 2025-06-04 14:32:35 +02:00
Documentation x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 2025-06-04 14:32:32 +02:00
drivers spi: spi-fsl-dspi: restrict register range for regmap access 2025-06-04 14:32:36 +02:00
fs __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock 2025-06-04 14:32:35 +02:00
include netfilter: nf_tables: do not defer rule destruction via call_rcu 2025-06-04 14:32:36 +02:00
init sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP 2025-05-02 07:39:28 +02:00
ipc ipc: replace costly bailout check in sysvipc_find_ipc() 2024-09-04 13:15:02 +02:00
kernel rcu: handle quiescent states for PREEMPT_RCU=n, PREEMPT_COUNT=y 2025-06-04 14:32:34 +02:00
lib dql: Fix dql->limit value when reset. 2025-06-04 14:32:30 +02:00
LICENSES LICENSES: Rename other to deprecated 2019-05-03 06:34:32 -06:00
mm mm/page_alloc.c: avoid infinite retries caused by cpuset race 2025-06-04 14:32:36 +02:00
net netfilter: nf_tables: do not defer rule destruction via call_rcu 2025-06-04 14:32:36 +02:00
samples samples/bpf: Fix a resource leak 2024-12-14 19:44:50 +01:00
scripts kbuild: fix argument parsing in scripts/config 2025-06-04 14:32:31 +02:00
security smack: recognize ipv4 CIPSO w/o categories 2025-06-04 14:32:33 +02:00
sound ALSA: pcm: Fix race of buffer access at PCM OSS layer 2025-06-04 14:32:35 +02:00
tools bpftool: Fix readlink usage in get_fd_type 2025-06-04 14:32:34 +02:00
usr initramfs: restore default compression behavior 2020-04-08 09:08:38 +02:00
virt KVM: arm64: Ignore PMCNTENSET_EL0 while checking for overflow status 2024-12-19 18:05:04 +01:00
.clang-format clang-format: Update with the latest for_each macro list 2019-08-31 10:00:51 +02:00
.cocciconfig
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes
.gitignore Remove *.orig pattern from .gitignore 2024-11-08 16:20:33 +01:00
.mailmap ARM: SoC fixes 2019-11-10 13:41:59 -08:00
COPYING
CREDITS MAINTAINERS: Remove Simon as Renesas SoC Co-Maintainer 2019-10-10 08:12:51 -07:00
Kbuild kbuild: do not descend to ./Kbuild when cleaning 2019-08-21 21:03:58 +09:00
Kconfig docs: kbuild: convert docs to ReST and rename to *.rst 2019-06-14 14:21:21 -06:00
MAINTAINERS iio: stx104: Move to addac subdirectory 2023-08-30 16:27:12 +02:00
Makefile kbuild: Disable -Wdefault-const-init-unsafe 2025-06-04 14:32:36 +02:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.