• Taehee Yoo's avatar
    netfilter: nf_tables: fix suspicious RCU usage in nft_chain_stats_replace() · 4c05ec47
    Taehee Yoo authored
    basechain->stats is rcu protected data which is updated from
    nft_chain_stats_replace(). This function is executed from the commit
    phase which holds the pernet nf_tables commit mutex - not the global
    nfnetlink subsystem mutex.
    
    Test commands to reproduce the problem are:
       %iptables-nft -I INPUT
       %iptables-nft -Z
       %iptables-nft -Z
    
    This patch uses RCU calls to handle basechain->stats updates to fix a
    splat that looks like:
    
    [89279.358755] =============================
    [89279.363656] WARNING: suspicious RCU usage
    [89279.368458] 4.20.0-rc2+ #44 Tainted: G        W    L
    [89279.374661] -----------------------------
    [89279.379542] net/netfilter/nf_tables_api.c:1404 suspicious rcu_dereference_protected() usage!
    [...]
    [89279.406556] 1 lock held by iptables-nft/5225:
    [89279.411728]  #0: 00000000bf45a000 (&net->nft.commit_mutex){+.+.}, at: nf_tables_valid_genid+0x1f/0x70 [nf_tables]
    [89279.424022] stack backtrace:
    [89279.429236] CPU: 0 PID: 5225 Comm: iptables-nft Tainted: G        W    L    4.20.0-rc2+ #44
    [89279.430135] Call Trace:
    [89279.430135]  dump_stack+0xc9/0x16b
    [89279.430135]  ? show_regs_print_info+0x5/0x5
    [89279.430135]  ? lockdep_rcu_suspicious+0x117/0x160
    [89279.430135]  nft_chain_commit_update+0x4ea/0x640 [nf_tables]
    [89279.430135]  ? sched_clock_local+0xd4/0x140
    [89279.430135]  ? check_flags.part.35+0x440/0x440
    [89279.430135]  ? __rhashtable_remove_fast.constprop.67+0xec0/0xec0 [nf_tables]
    [89279.430135]  ? sched_clock_cpu+0x126/0x170
    [89279.430135]  ? find_held_lock+0x39/0x1c0
    [89279.430135]  ? hlock_class+0x140/0x140
    [89279.430135]  ? is_bpf_text_address+0x5/0xf0
    [89279.430135]  ? check_flags.part.35+0x440/0x440
    [89279.430135]  ? __lock_is_held+0xb4/0x140
    [89279.430135]  nf_tables_commit+0x2555/0x39c0 [nf_tables]
    
    Fixes: f102d66b ("netfilter: nf_tables: use dedicated mutex to guard transactions")
    Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    4c05ec47
Name
Last commit
Last update
..
ipset Loading commit data...
nf_conntrack_amanda.h Loading commit data...
nf_conntrack_common.h Loading commit data...
nf_conntrack_dccp.h Loading commit data...
nf_conntrack_ftp.h Loading commit data...
nf_conntrack_h323.h Loading commit data...
nf_conntrack_h323_asn1.h Loading commit data...
nf_conntrack_h323_types.h Loading commit data...
nf_conntrack_irc.h Loading commit data...
nf_conntrack_pptp.h Loading commit data...
nf_conntrack_proto_gre.h Loading commit data...
nf_conntrack_sane.h Loading commit data...
nf_conntrack_sctp.h Loading commit data...
nf_conntrack_sip.h Loading commit data...
nf_conntrack_snmp.h Loading commit data...
nf_conntrack_tcp.h Loading commit data...
nf_conntrack_tftp.h Loading commit data...
nf_conntrack_zones_common.h Loading commit data...
nfnetlink.h Loading commit data...
nfnetlink_acct.h Loading commit data...
nfnetlink_osf.h Loading commit data...
x_tables.h Loading commit data...
xt_hashlimit.h Loading commit data...
xt_physdev.h Loading commit data...