| Message ID | 20230815223011.7019-2-fw@strlen.de (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | b9f052dc68f69dac89fe1e24693354c033daa091 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,1/9] netfilter: nf_tables: fix false-positive lockdep splat | expand |
Hello: This series was applied to netdev/net.git (main) by Florian Westphal <fw@strlen.de>: On Wed, 16 Aug 2023 00:29:51 +0200 you wrote: > ->abort invocation may cause splat on debug kernels: > > WARNING: suspicious RCU usage > net/netfilter/nft_set_pipapo.c:1697 suspicious rcu_dereference_check() usage! > [..] > rcu_scheduler_active = 2, debug_locks = 1 > 1 lock held by nft/133554: [..] (nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid > [..] > lockdep_rcu_suspicious+0x1ad/0x260 > nft_pipapo_abort+0x145/0x180 > __nf_tables_abort+0x5359/0x63d0 > nf_tables_abort+0x24/0x40 > nfnetlink_rcv+0x1a0a/0x22c0 > netlink_unicast+0x73c/0x900 > netlink_sendmsg+0x7f0/0xc20 > ____sys_sendmsg+0x48d/0x760 > > [...] Here is the summary with links: - [net,1/9] netfilter: nf_tables: fix false-positive lockdep splat https://git.kernel.org/netdev/net/c/b9f052dc68f6 - [net,2/9] netfilter: nf_tables: fix kdoc warnings after gc rework https://git.kernel.org/netdev/net/c/08713cb006b6 - [net,3/9] netfilter: nf_tables: deactivate catchall elements in next generation https://git.kernel.org/netdev/net/c/90e5b3462efa - [net,4/9] netfilter: nf_tables: don't fail inserts if duplicate has expired https://git.kernel.org/netdev/net/c/7845914f45f0 - [net,5/9] netfilter: set default timeout to 3 secs for sctp shutdown send and recv state https://git.kernel.org/netdev/net/c/9bfab6d23a28 - [net,6/9] ipvs: fix racy memcpy in proc_do_sync_threshold https://git.kernel.org/netdev/net/c/5310760af1d4 - [net,7/9] netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path https://git.kernel.org/netdev/net/c/6a33d8b73dfa - [net,8/9] netfilter: nf_tables: GC transaction race with netns dismantle https://git.kernel.org/netdev/net/c/02c6c24402bf - [net,9/9] netfilter: nft_dynset: disallow object maps https://git.kernel.org/netdev/net/c/23185c6aed1f You are awesome, thank you!
diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index a5b8301afe4a..5fa12cfc7b84 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1697,6 +1697,17 @@ static void nft_pipapo_commit(const struct nft_set *set) priv->clone = new_clone; } +static bool nft_pipapo_transaction_mutex_held(const struct nft_set *set) +{ +#ifdef CONFIG_PROVE_LOCKING + const struct net *net = read_pnet(&set->net); + + return lockdep_is_held(&nft_pernet(net)->commit_mutex); +#else + return true; +#endif +} + static void nft_pipapo_abort(const struct nft_set *set) { struct nft_pipapo *priv = nft_set_priv(set); @@ -1705,7 +1716,7 @@ static void nft_pipapo_abort(const struct nft_set *set) if (!priv->dirty) return; - m = rcu_dereference(priv->match); + m = rcu_dereference_protected(priv->match, nft_pipapo_transaction_mutex_held(set)); new_clone = pipapo_clone(m); if (IS_ERR(new_clone))
->abort invocation may cause splat on debug kernels: WARNING: suspicious RCU usage net/netfilter/nft_set_pipapo.c:1697 suspicious rcu_dereference_check() usage! [..] rcu_scheduler_active = 2, debug_locks = 1 1 lock held by nft/133554: [..] (nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid [..] lockdep_rcu_suspicious+0x1ad/0x260 nft_pipapo_abort+0x145/0x180 __nf_tables_abort+0x5359/0x63d0 nf_tables_abort+0x24/0x40 nfnetlink_rcv+0x1a0a/0x22c0 netlink_unicast+0x73c/0x900 netlink_sendmsg+0x7f0/0xc20 ____sys_sendmsg+0x48d/0x760 Transaction mutex is held, so parallel updates are not possible. Switch to _protected and check mutex is held for lockdep enabled builds. Fixes: 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol") Signed-off-by: Florian Westphal <fw@strlen.de> --- net/netfilter/nft_set_pipapo.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)