| Message ID | 20230823152711.15279-2-fw@strlen.de (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 4b80ced971b0d118f9a11dd503a5833a5016de92 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,1/6] netfilter: nf_tables: validate all pending tables | expand |
Hello: This series was applied to netdev/net.git (main) by Florian Westphal <fw@strlen.de>: On Wed, 23 Aug 2023 17:26:49 +0200 you wrote: > We have to validate all tables in the transaction that are in > VALIDATE_DO state, the blamed commit below did not move the break > statement to its right location so we only validate one table. > > Moreover, we can't init table->validate to _SKIP when a table object > is allocated. > > [...] Here is the summary with links: - [net,1/6] netfilter: nf_tables: validate all pending tables https://git.kernel.org/netdev/net/c/4b80ced971b0 - [net,2/6] netfilter: nf_tables: flush pending destroy work before netlink notifier https://git.kernel.org/netdev/net/c/2c9f0293280e - [net,3/6] netfilter: nf_tables: GC transaction race with abort path https://git.kernel.org/netdev/net/c/720344340fb9 - [net,4/6] netfilter: nf_tables: use correct lock to protect gc_list https://git.kernel.org/netdev/net/c/8357bc946a2a - [net,5/6] netfilter: nf_tables: fix out of memory error handling https://git.kernel.org/netdev/net/c/5e1be4cdc98c - [net,6/6] netfilter: nf_tables: defer gc run if previous batch is still pending https://git.kernel.org/netdev/net/c/8e51830e29e1 You are awesome, thank you!
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index e9ae567c037d..ffcbdf08380f 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -1729,6 +1729,7 @@ struct nftables_pernet { u64 table_handle; unsigned int base_seq; unsigned int gc_seq; + u8 validate_state; }; extern unsigned int nf_tables_net_id; diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 3e841e45f2c0..a76a62ebe9c9 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1373,7 +1373,7 @@ static int nf_tables_newtable(struct sk_buff *skb, const struct nfnl_info *info, if (table == NULL) goto err_kzalloc; - table->validate_state = NFT_VALIDATE_SKIP; + table->validate_state = nft_net->validate_state; table->name = nla_strdup(attr, GFP_KERNEL_ACCOUNT); if (table->name == NULL) goto err_strdup; @@ -9051,9 +9051,8 @@ static int nf_tables_validate(struct net *net) return -EAGAIN; nft_validate_state_update(table, NFT_VALIDATE_SKIP); + break; } - - break; } return 0; @@ -9799,8 +9798,10 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) } /* 0. Validate ruleset, otherwise roll back for error reporting. */ - if (nf_tables_validate(net) < 0) + if (nf_tables_validate(net) < 0) { + nft_net->validate_state = NFT_VALIDATE_DO; return -EAGAIN; + } err = nft_flow_rule_offload_commit(net); if (err < 0) @@ -10059,6 +10060,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) nf_tables_commit_audit_log(&adl, nft_net->base_seq); nft_gc_seq_end(nft_net, gc_seq); + nft_net->validate_state = NFT_VALIDATE_SKIP; nf_tables_commit_release(net); return 0; @@ -11115,6 +11117,7 @@ static int __net_init nf_tables_init_net(struct net *net) mutex_init(&nft_net->commit_mutex); nft_net->base_seq = 1; nft_net->gc_seq = 0; + nft_net->validate_state = NFT_VALIDATE_SKIP; return 0; }
We have to validate all tables in the transaction that are in VALIDATE_DO state, the blamed commit below did not move the break statement to its right location so we only validate one table. Moreover, we can't init table->validate to _SKIP when a table object is allocated. If we do, then if a transcaction creates a new table and then fails the transaction, nfnetlink will loop and nft will hang until user cancels the command. Add back the pernet state as a place to stash the last state encountered. This is either _DO (we hit an error during commit validation) or _SKIP (transaction passed all checks). Fixes: 00c320f9b755 ("netfilter: nf_tables: make validation state per table") Reported-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de> --- include/net/netfilter/nf_tables.h | 1 + net/netfilter/nf_tables_api.c | 11 +++++++---- 2 files changed, 8 insertions(+), 4 deletions(-)