Commit 17a8f31b authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: egress: silence egress hook lockdep splats 



Netfilter assumes its called with rcu_read_lock held, but in egress
hook case it may be called with BH readlock.

This triggers lockdep splat.

In order to avoid to change all rcu_dereference() to
rcu_dereference_check(..., rcu_read_lock_bh_held()), wrap nf_hook_slow
with read lock/unlock pair.

Reported-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 56763f12

include/linux/netfilter_netdev.h

+4 −0
Original line number Diff line number Diff line
@@ -101,7 +101,11 @@ static inline struct sk_buff *nf_hook_egress(struct sk_buff *skb, int *rc, 
	nf_hook_state_init(&state, NF_NETDEV_EGRESS,

			   NFPROTO_NETDEV, dev, NULL, NULL,

			   dev_net(dev), NULL);



	/* nf assumes rcu_read_lock, not just read_lock_bh */

	rcu_read_lock();

	ret = nf_hook_slow(skb, &state, e, 0);

	rcu_read_unlock();



	if (ret == 1) {

		return skb;