From: Florian Westphal <fw@strlen•de>
To: <netdev@vger•kernel.org>
Cc: Paolo Abeni <pabeni@redhat•com>,
"David S. Miller" <davem@davemloft•net>,
Eric Dumazet <edumazet@google•com>,
Jakub Kicinski <kuba@kernel•org>,
<netfilter-devel@vger•kernel.org>,
Pablo Neira Ayuso <pablo@netfilter•org>
Subject: [PATCH net 4/6] netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
Date: Wed, 6 Sep 2023 18:25:10 +0200 [thread overview]
Message-ID: <20230906162525.11079-5-fw@strlen.de> (raw)
In-Reply-To: <20230906162525.11079-1-fw@strlen.de>
From: Pablo Neira Ayuso <pablo@netfilter•org>
New elements in this transaction might expired before such transaction
ends. Skip sync GC for such elements otherwise commit path might walk
over an already released object. Once transaction is finished, async GC
will collect such expired element.
Fixes: f6c383b8c31a ("netfilter: nf_tables: adapt set backend to use GC transaction API")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter•org>
Signed-off-by: Florian Westphal <fw@strlen•de>
---
net/netfilter/nft_set_rbtree.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index c6435e709231..f250b5399344 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -312,6 +312,7 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
struct nft_rbtree_elem *rbe, *rbe_le = NULL, *rbe_ge = NULL;
struct rb_node *node, *next, *parent, **p, *first = NULL;
struct nft_rbtree *priv = nft_set_priv(set);
+ u8 cur_genmask = nft_genmask_cur(net);
u8 genmask = nft_genmask_next(net);
int d, err;
@@ -357,8 +358,11 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
if (!nft_set_elem_active(&rbe->ext, genmask))
continue;
- /* perform garbage collection to avoid bogus overlap reports. */
- if (nft_set_elem_expired(&rbe->ext)) {
+ /* perform garbage collection to avoid bogus overlap reports
+ * but skip new elements in this transaction.
+ */
+ if (nft_set_elem_expired(&rbe->ext) &&
+ nft_set_elem_active(&rbe->ext, cur_genmask)) {
err = nft_rbtree_gc_elem(set, priv, rbe, genmask);
if (err < 0)
return err;
--
2.41.0
next prev parent reply other threads:[~2023-09-06 16:25 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-06 16:25 [PATCH net 0/6] netfilter updates for net Florian Westphal
2023-09-06 16:25 ` [PATCH net 1/6] netfilter: nftables: exthdr: fix 4-byte stack OOB write Florian Westphal
2023-09-07 10:40 ` patchwork-bot+netdevbpf
2023-09-06 16:25 ` [PATCH net 2/6] netfilter: nfnetlink_osf: avoid OOB read Florian Westphal
2023-09-06 16:25 ` [PATCH net 3/6] netfilter: nf_tables: uapi: Describe NFTA_RULE_CHAIN_ID Florian Westphal
2023-09-06 16:25 ` Florian Westphal [this message]
2023-09-06 16:25 ` [PATCH net 5/6] netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c Florian Westphal
2023-09-06 16:25 ` [PATCH net 6/6] netfilter: nf_tables: Unbreak audit log reset Florian Westphal
2023-09-06 21:41 ` Phil Sutter
2023-09-06 22:41 ` Florian Westphal
2023-09-07 10:30 ` Phil Sutter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230906162525.11079-5-fw@strlen.de \
--to=fw@strlen$(echo .)de \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=kuba@kernel$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=netfilter-devel@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=pablo@netfilter$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox