github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-06 21:45:45 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

netfilter: flowtable_offload: add missing locking

Browse Source 
[ Upstream commit bcd9e3c165 ]

nf_flow_table_block_setup and the driver TC_SETUP_FT call can modify the flow
block cb list while they are being traversed elsewhere, causing a crash.
Add a write lock around the calls to protect readers

Fixes: c29f74e0df ("netfilter: nf_flow_table: hardware offload support")
Reported-by: Chad Monroe <chad.monroe@smartrg.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Felix Fietkau 2022-11-21 19:26:15 +01:00 committed by Greg Kroah-Hartman
parent af9de5cdcb
commit b8e494240e
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/netfilter/nf_flow_table_offload.c
View File

@ -910,6 +910,7 @@ static int nf_flow_table_block_setup(struct nf_flowtable *flowtable,
struct flow_block_cb *block_cb, *next; struct flow_block_cb *block_cb, *next;
int err = 0; int err = 0;
down_write(&flowtable->flow_block_lock);
switch (cmd) { switch (cmd) {
case FLOW_BLOCK_BIND: case FLOW_BLOCK_BIND:
list_splice(&bo->cb_list, &flowtable->flow_block.cb_list); list_splice(&bo->cb_list, &flowtable->flow_block.cb_list);
@ -924,6 +925,7 @@ static int nf_flow_table_block_setup(struct nf_flowtable *flowtable,
WARN_ON_ONCE(1); WARN_ON_ONCE(1);
err = -EOPNOTSUPP; err = -EOPNOTSUPP;
} }
up_write(&flowtable->flow_block_lock);
return err; return err;
} }
@ -980,7 +982,9 @@ static int nf_flow_table_offload_cmd(struct flow_block_offload *bo,
nf_flow_table_block_offload_init(bo, dev_net(dev), cmd, flowtable, nf_flow_table_block_offload_init(bo, dev_net(dev), cmd, flowtable,
extack); extack);
down_write(&flowtable->flow_block_lock);
err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_FT, bo); err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_FT, bo);
up_write(&flowtable->flow_block_lock);
if (err < 0) if (err < 0)
return err; return err;