diff mbox series

[net] netfilter: nf_tables: Fix memory leak in nf_flow_offload_xdp_setup()

Message ID 20241011-flowtable-xdp-memleak-v1-1-b32aacb65b99@kernel.org (mailing list archive)
State Awaiting Upstream
Delegated to: Netdev Maintainers
Headers show
Series [net] netfilter: nf_tables: Fix memory leak in nf_flow_offload_xdp_setup() | expand

Checks

Context Check Description
netdev/series_format success Single patches do not need cover letters
netdev/tree_selection success Clearly marked for net
netdev/ynl success Generated files up to date; no warnings/errors; no diff in generated;
netdev/fixes_present success Fixes tag present in non-next series
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 5 this patch: 5
netdev/build_tools success No tools touched, skip
netdev/cc_maintainers success CCed 15 of 15 maintainers
netdev/build_clang success Errors and warnings before: 3 this patch: 3
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success Fixes tag looks correct
netdev/build_allmodconfig_warn success Errors and warnings before: 20 this patch: 20
netdev/checkpatch warning WARNING: line length of 81 exceeds 80 columns
netdev/build_clang_rust success No Rust files in patch. Skipping build
netdev/kdoc success Errors and warnings before: 5 this patch: 5
netdev/source_inline success Was 0 now: 0
netdev/contest success net-next-2024-10-12--12-00 (tests: 777)

Commit Message

Lorenzo Bianconi Oct. 10, 2024, 11:31 p.m. UTC 
nf_flow_offload_xdp_setup routine allocates/removes entries in
nf_xdp_hashtable hash running FLOW_BLOCK_BIND/FLOW_BLOCK_UNBIND
commands. In the current codebase we have an FLOW_BLOCK_BIND/
FLOW_BLOCK_UNBIND unbalance since we do not run FLOW_BLOCK_UNBIND in
__nft_unregister_flowtable_net_hooks() triggering the following error
reported by kmeamlak:

[<00000000be65a589>] __kmalloc_cache_noprof+0x280/0x310
[<00000000c6569ad4>] nf_flow_offload_xdp_setup+0x70/0x8d0 [nf_flow_table]
[<000000001efe6e35>] nf_flow_table_offload_setup+0x324/0x610 [nf_flow_table]
[<000000005d9c9ad6>] nft_register_flowtable_net_hooks+0x3f4/0x890 [nf_tables]
[<00000000de9071ee>] nf_tables_newflowtable+0xf61/0x18c0 [nf_tables]
[<00000000924f5d86>] nfnetlink_rcv_batch+0x12c1/0x1c50 [nfnetlink]
[<000000003fa07104>] nfnetlink_rcv+0x2a3/0x320 [nfnetlink]
[<000000009fd1c990>] netlink_unicast+0x588/0x7f0
[<00000000ee126795>] netlink_sendmsg+0x702/0xba0
[<000000000ddf29fb>] ____sys_sendmsg+0x7cd/0x9a0
[<0000000027b80416>] ___sys_sendmsg+0xd6/0x140
[<00000000edfe1eb5>] __sys_sendmsg+0xba/0x150
[<000000009d5eb571>] do_syscall_64+0x47/0x110
[<0000000077c3a21e>] entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fix the issue running FLOW_BLOCK_UNBIND command in
__nft_unregister_flowtable_net_hooks() if the nft_hook is removed.

Fixes: 89cc8f1c5f22 ("netfilter: nf_tables: Add flowtable map for xdp offload")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
---
 net/netfilter/nf_tables_api.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)


---
base-commit: 1d227fcc72223cbdd34d0ce13541cbaab5e0d72f
change-id: 20241011-flowtable-xdp-memleak-05cdd4c22369

Best regards,
diff mbox series

Patch

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index a24fe62650a753be872a2051b34ff0aba27ef8c4..53357b61700b01048e840154dffd55a2c05062c1 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -8546,14 +8546,18 @@  static void nft_unregister_flowtable_hook(struct net *net,
 }
 
 static void __nft_unregister_flowtable_net_hooks(struct net *net,
-						 struct list_head *hook_list,
-					         bool release_netdev)
+						 struct nft_flowtable *flowtable,
+						 struct list_head *hook_list)
 {
 	struct nft_hook *hook, *next;
 
 	list_for_each_entry_safe(hook, next, hook_list, list) {
+		if (flowtable)
+			flowtable->data.type->setup(&flowtable->data,
+						    hook->ops.dev,
+						    FLOW_BLOCK_UNBIND);
 		nf_unregister_net_hook(net, &hook->ops);
-		if (release_netdev) {
+		if (flowtable) {
 			list_del(&hook->list);
 			kfree_rcu(hook, rcu);
 		}
@@ -8563,7 +8567,7 @@  static void __nft_unregister_flowtable_net_hooks(struct net *net,
 static void nft_unregister_flowtable_net_hooks(struct net *net,
 					       struct list_head *hook_list)
 {
-	__nft_unregister_flowtable_net_hooks(net, hook_list, false);
+	__nft_unregister_flowtable_net_hooks(net, NULL, hook_list);
 }
 
 static int nft_register_flowtable_net_hooks(struct net *net,
@@ -11459,8 +11463,8 @@  static void __nft_release_hook(struct net *net, struct nft_table *table)
 	list_for_each_entry(chain, &table->chains, list)
 		__nf_tables_unregister_hook(net, table, chain, true);
 	list_for_each_entry(flowtable, &table->flowtables, list)
-		__nft_unregister_flowtable_net_hooks(net, &flowtable->hook_list,
-						     true);
+		__nft_unregister_flowtable_net_hooks(net, flowtable,
+						     &flowtable->hook_list);
 }
 
 static void __nft_release_hooks(struct net *net)