Commit 18f3001b authored by Lu Wei's avatar Lu Wei
Browse files

Revert "netfilter: nf_tables: fix chain binding transaction logic" 

hulk inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I86JB6



-------------------------------

This reverts commit 04982868.

Backport the dependency patch and then re-backport this patch.

Signed-off-by: default avatarLu Wei <luwei32@huawei.com>
parent d7e27bfe

include/net/netfilter/nf_tables.h

+1 −20
Original line number Diff line number Diff line
@@ -908,10 +908,7 @@ static inline struct nft_userdata *nft_userdata(const struct nft_rule *rule) 
	return (void *)&rule->data[rule->dlen];

}



void nft_rule_expr_activate(const struct nft_ctx *ctx, struct nft_rule *rule);

void nft_rule_expr_deactivate(const struct nft_ctx *ctx, struct nft_rule *rule,

			      enum nft_trans_phase phase);

void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule);

void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule);



static inline void nft_set_elem_update_expr(const struct nft_set_ext *ext,

					    struct nft_regs *regs,
@@ -970,7 +967,6 @@ struct nft_chain { 
};



int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain);

int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain);



enum nft_chain_types {

	NFT_CHAIN_T_DEFAULT = 0,
@@ -1007,17 +1003,11 @@ int nft_chain_validate_dependency(const struct nft_chain *chain, 
int nft_chain_validate_hooks(const struct nft_chain *chain,

                             unsigned int hook_flags);



static inline bool nft_chain_binding(const struct nft_chain *chain)

{

	return chain->flags & NFT_CHAIN_BINDING;

}



static inline bool nft_chain_is_bound(struct nft_chain *chain)

{

	return (chain->flags & NFT_CHAIN_BINDING) && chain->bound;

}



int nft_chain_add(struct nft_table *table, struct nft_chain *chain);

void nft_chain_del(struct nft_chain *chain);

void nf_tables_chain_destroy(struct nft_ctx *ctx);
@@ -1442,7 +1432,6 @@ struct nft_trans_rule { 
	struct nft_rule			*rule;

	struct nft_flow_rule		*flow;

	u32				rule_id;

	bool				bound;

};



#define nft_trans_rule(trans)	\
@@ -1451,8 +1440,6 @@ struct nft_trans_rule { 
	(((struct nft_trans_rule *)trans->data)->flow)

#define nft_trans_rule_id(trans)	\

	(((struct nft_trans_rule *)trans->data)->rule_id)

#define nft_trans_rule_bound(trans)	\

	(((struct nft_trans_rule *)trans->data)->bound)



struct nft_trans_set {

	struct nft_set			*set;
@@ -1468,17 +1455,13 @@ struct nft_trans_set { 
	(((struct nft_trans_set *)trans->data)->bound)



struct nft_trans_chain {

	struct nft_chain		*chain;

	bool				update;

	char				*name;

	struct nft_stats __percpu	*stats;

	u8				policy;

	bool				bound;

	u32				chain_id;

};



#define nft_trans_chain(trans)	\

	(((struct nft_trans_chain *)trans->data)->chain)

#define nft_trans_chain_update(trans)	\

	(((struct nft_trans_chain *)trans->data)->update)

#define nft_trans_chain_name(trans)	\
@@ -1487,8 +1470,6 @@ struct nft_trans_chain { 
	(((struct nft_trans_chain *)trans->data)->stats)

#define nft_trans_chain_policy(trans)	\

	(((struct nft_trans_chain *)trans->data)->policy)

#define nft_trans_chain_bound(trans)	\

	(((struct nft_trans_chain *)trans->data)->bound)

#define nft_trans_chain_id(trans)	\

	(((struct nft_trans_chain *)trans->data)->chain_id)

net/netfilter/nf_tables_api.c

+31 −53
Original line number Diff line number Diff line
@@ -190,46 +190,6 @@ static void nft_set_trans_bind(const struct nft_ctx *ctx, struct nft_set *set) 
	}

}



static void nft_chain_trans_bind(const struct nft_ctx *ctx, struct nft_chain *chain)

{

	struct net *net = ctx->net;

	struct nft_trans *trans;



	if (!nft_chain_binding(chain))

		return;



	list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {

		switch (trans->msg_type) {

		case NFT_MSG_NEWCHAIN:

			if (nft_trans_chain(trans) == chain)

				nft_trans_chain_bound(trans) = true;

			break;

		case NFT_MSG_NEWRULE:

			if (trans->ctx.chain == chain)

				nft_trans_rule_bound(trans) = true;

			break;

		}

	}

}



int nf_tables_bind_chain(const struct nft_ctx *ctx, struct nft_chain *chain)

{

	if (!nft_chain_binding(chain))

		return 0;



	if (nft_chain_binding(ctx->chain))

		return -EOPNOTSUPP;



	if (chain->bound)

		return -EBUSY;



	chain->bound = true;

	chain->use++;

	nft_chain_trans_bind(ctx, chain);



	return 0;

}



static int nft_netdev_register_hooks(struct net *net,

				     struct list_head *hook_list)

{
@@ -353,9 +313,8 @@ static struct nft_trans *nft_trans_chain_add(struct nft_ctx *ctx, int msg_type) 
				ntohl(nla_get_be32(ctx->nla[NFTA_CHAIN_ID]));

		}

	}

	nft_trans_chain(trans) = ctx->chain;

	list_add_tail(&trans->list, &ctx->net->nft.commit_list);



	list_add_tail(&trans->list, &ctx->net->nft.commit_list);

	return trans;

}
@@ -373,7 +332,8 @@ static int nft_delchain(struct nft_ctx *ctx) 
	return 0;

}



void nft_rule_expr_activate(const struct nft_ctx *ctx, struct nft_rule *rule)

static void nft_rule_expr_activate(const struct nft_ctx *ctx,

				   struct nft_rule *rule)

{

	struct nft_expr *expr;
@@ -386,7 +346,8 @@ void nft_rule_expr_activate(const struct nft_ctx *ctx, struct nft_rule *rule) 
	}

}



void nft_rule_expr_deactivate(const struct nft_ctx *ctx, struct nft_rule *rule,

static void nft_rule_expr_deactivate(const struct nft_ctx *ctx,

				     struct nft_rule *rule,

				     enum nft_trans_phase phase)

{

	struct nft_expr *expr;
@@ -2020,7 +1981,7 @@ static int nft_basechain_init(struct nft_base_chain *basechain, u8 family, 
	return 0;

}



int nft_chain_add(struct nft_table *table, struct nft_chain *chain)

static int nft_chain_add(struct nft_table *table, struct nft_chain *chain)

{

	int err;
@@ -3116,7 +3077,8 @@ static int nf_tables_getrule(struct net *net, struct sock *nlsk, 
	return err;

}



void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule)

static void nf_tables_rule_destroy(const struct nft_ctx *ctx,

				   struct nft_rule *rule)

{

	struct nft_expr *expr, *next;
@@ -3133,7 +3095,7 @@ void nf_tables_rule_destroy(const struct nft_ctx *ctx, struct nft_rule *rule) 
	kfree(rule);

}



static void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule)

void nf_tables_rule_release(const struct nft_ctx *ctx, struct nft_rule *rule)

{

	nft_rule_expr_deactivate(ctx, rule, NFT_TRANS_RELEASE);

	nf_tables_rule_destroy(ctx, rule);
@@ -5533,6 +5495,7 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk, 
void nft_data_hold(const struct nft_data *data, enum nft_data_types type)

{

	struct nft_chain *chain;

	struct nft_rule *rule;



	if (type == NFT_DATA_VERDICT) {

		switch (data->verdict.code) {
@@ -5540,6 +5503,15 @@ void nft_data_hold(const struct nft_data *data, enum nft_data_types type) 
		case NFT_GOTO:

			chain = data->verdict.chain;

			chain->use++;



			if (!nft_chain_is_bound(chain))

				break;



			chain->table->use++;

			list_for_each_entry(rule, &chain->rules, list)

				chain->use++;



			nft_chain_add(chain->table, chain);

			break;

		}

	}
@@ -8205,7 +8177,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 
				kfree(nft_trans_chain_name(trans));

				nft_trans_destroy(trans);

			} else {

				if (nft_trans_chain_bound(trans)) {

				if (nft_chain_is_bound(trans->ctx.chain)) {

					nft_trans_destroy(trans);

					break;

				}
@@ -8222,10 +8194,6 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) 
			nft_trans_destroy(trans);

			break;

		case NFT_MSG_NEWRULE:

			if (nft_trans_rule_bound(trans)) {

				nft_trans_destroy(trans);

				break;

			}

			trans->ctx.chain->use--;

			list_del_rcu(&nft_trans_rule(trans)->list);

			nft_rule_expr_deactivate(&trans->ctx,
@@ -8762,12 +8730,22 @@ static int nft_verdict_init(const struct nft_ctx *ctx, struct nft_data *data, 
static void nft_verdict_uninit(const struct nft_data *data)

{

	struct nft_chain *chain;

	struct nft_rule *rule;



	switch (data->verdict.code) {

	case NFT_JUMP:

	case NFT_GOTO:

		chain = data->verdict.chain;

		chain->use--;



		if (!nft_chain_is_bound(chain))

			break;



		chain->table->use--;

		list_for_each_entry(rule, &chain->rules, list)

			chain->use--;



		nft_chain_del(chain);

		break;

	}

}

net/netfilter/nft_immediate.c

+9 −78
Original line number Diff line number Diff line
@@ -76,9 +76,11 @@ static int nft_immediate_init(const struct nft_ctx *ctx, 
		switch (priv->data.verdict.code) {

		case NFT_JUMP:

		case NFT_GOTO:

			err = nf_tables_bind_chain(ctx, chain);

			if (err < 0)

				return err;

			if (nft_chain_is_bound(chain)) {

				err = -EBUSY;

				goto err1;

			}

			chain->bound = true;

			break;

		default:

			break;
@@ -96,31 +98,6 @@ static void nft_immediate_activate(const struct nft_ctx *ctx, 
				   const struct nft_expr *expr)

{

	const struct nft_immediate_expr *priv = nft_expr_priv(expr);

	const struct nft_data *data = &priv->data;

	struct nft_ctx chain_ctx;

	struct nft_chain *chain;

	struct nft_rule *rule;



	if (priv->dreg == NFT_REG_VERDICT) {

		switch (data->verdict.code) {

		case NFT_JUMP:

		case NFT_GOTO:

			chain = data->verdict.chain;

			if (!nft_chain_binding(chain))

				break;



			chain_ctx = *ctx;

			chain_ctx.chain = chain;



			list_for_each_entry(rule, &chain->rules, list)

				nft_rule_expr_activate(&chain_ctx, rule);



			nft_clear(ctx->net, chain);

			break;

		default:

			break;

		}

	}



	return nft_data_hold(&priv->data, nft_dreg_to_type(priv->dreg));

}
@@ -130,40 +107,6 @@ static void nft_immediate_deactivate(const struct nft_ctx *ctx, 
				     enum nft_trans_phase phase)

{

	const struct nft_immediate_expr *priv = nft_expr_priv(expr);

	const struct nft_data *data = &priv->data;

	struct nft_ctx chain_ctx;

	struct nft_chain *chain;

	struct nft_rule *rule;



	if (priv->dreg == NFT_REG_VERDICT) {

		switch (data->verdict.code) {

		case NFT_JUMP:

		case NFT_GOTO:

			chain = data->verdict.chain;

			if (!nft_chain_binding(chain))

				break;



			chain_ctx = *ctx;

			chain_ctx.chain = chain;



			list_for_each_entry(rule, &chain->rules, list)

				nft_rule_expr_deactivate(&chain_ctx, rule, phase);



			switch (phase) {

			case NFT_TRANS_PREPARE:

				nft_deactivate_next(ctx->net, chain);

				break;

			default:

				nft_chain_del(chain);

				chain->bound = false;

				chain->table->use--;

				break;

			}

			break;

		default:

			break;

		}

	}



	if (phase == NFT_TRANS_COMMIT)

		return;
@@ -188,27 +131,15 @@ static void nft_immediate_destroy(const struct nft_ctx *ctx, 
	case NFT_GOTO:

		chain = data->verdict.chain;



		if (!nft_chain_binding(chain))

		if (!nft_chain_is_bound(chain))

			break;



		/* Rule construction failed, but chain is already bound:

		 * let the transaction records release this chain and its rules.

		 */

		if (chain->bound) {

			chain->use--;

			break;

		}



		/* Rule has been deleted, release chain and its rules. */

		chain_ctx = *ctx;

		chain_ctx.chain = chain;



		chain->use--;

		list_for_each_entry_safe(rule, n, &chain->rules, list) {

			chain->use--;

			list_del(&rule->list);

			nf_tables_rule_destroy(&chain_ctx, rule);

		}

		list_for_each_entry_safe(rule, n, &chain->rules, list)

			nf_tables_rule_release(&chain_ctx, rule);



		nf_tables_chain_destroy(&chain_ctx);

		break;

	default: