Commit 4a9e12ea authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nft_set_pipapo: call nft_trans_gc_queue_sync() in catchall GC 



pipapo needs to enqueue GC transactions for catchall elements through
nft_trans_gc_queue_sync(). Add nft_trans_gc_catchall_sync() and
nft_trans_gc_catchall_async() to handle GC transaction queueing
accordingly.

Fixes: 5f68718b ("netfilter: nf_tables: GC transaction API to avoid race with control plane")
Fixes: f6c383b8 ("netfilter: nf_tables: adapt set backend to use GC transaction API")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 96b33300

include/net/netfilter/nf_tables.h

+3 −2
Original line number Diff line number Diff line
@@ -1700,8 +1700,9 @@ void nft_trans_gc_queue_sync_done(struct nft_trans_gc *trans); 


void nft_trans_gc_elem_add(struct nft_trans_gc *gc, void *priv);



struct nft_trans_gc *nft_trans_gc_catchall(struct nft_trans_gc *gc,

struct nft_trans_gc *nft_trans_gc_catchall_async(struct nft_trans_gc *gc,

						 unsigned int gc_seq);

struct nft_trans_gc *nft_trans_gc_catchall_sync(struct nft_trans_gc *gc);



void nft_setelem_data_deactivate(const struct net *net,

				 const struct nft_set *set,

net/netfilter/nf_tables_api.c

+19 −3
Original line number Diff line number Diff line
@@ -9613,8 +9613,9 @@ void nft_trans_gc_queue_sync_done(struct nft_trans_gc *trans) 
	call_rcu(&trans->rcu, nft_trans_gc_trans_free);

}



struct nft_trans_gc *nft_trans_gc_catchall(struct nft_trans_gc *gc,

					   unsigned int gc_seq)

static struct nft_trans_gc *nft_trans_gc_catchall(struct nft_trans_gc *gc,

						  unsigned int gc_seq,

						  bool sync)

{

	struct nft_set_elem_catchall *catchall;

	const struct nft_set *set = gc->set;
@@ -9630,7 +9631,11 @@ struct nft_trans_gc *nft_trans_gc_catchall(struct nft_trans_gc *gc, 


		nft_set_elem_dead(ext);

dead_elem:

		if (sync)

			gc = nft_trans_gc_queue_sync(gc, GFP_ATOMIC);

		else

			gc = nft_trans_gc_queue_async(gc, gc_seq, GFP_ATOMIC);



		if (!gc)

			return NULL;
@@ -9640,6 +9645,17 @@ struct nft_trans_gc *nft_trans_gc_catchall(struct nft_trans_gc *gc, 
	return gc;

}



struct nft_trans_gc *nft_trans_gc_catchall_async(struct nft_trans_gc *gc,

						 unsigned int gc_seq)

{

	return nft_trans_gc_catchall(gc, gc_seq, false);

}



struct nft_trans_gc *nft_trans_gc_catchall_sync(struct nft_trans_gc *gc)

{

	return nft_trans_gc_catchall(gc, 0, true);

}



static void nf_tables_module_autoload_cleanup(struct net *net)

{

	struct nftables_pernet *nft_net = nft_pernet(net);

net/netfilter/nft_set_hash.c

+1 −1
Original line number Diff line number Diff line
@@ -372,7 +372,7 @@ static void nft_rhash_gc(struct work_struct *work) 
		nft_trans_gc_elem_add(gc, he);

	}



	gc = nft_trans_gc_catchall(gc, gc_seq);

	gc = nft_trans_gc_catchall_async(gc, gc_seq);



try_later:

	/* catchall list iteration requires rcu read side lock. */

net/netfilter/nft_set_pipapo.c

+1 −1
Original line number Diff line number Diff line
@@ -1610,7 +1610,7 @@ static void pipapo_gc(const struct nft_set *_set, struct nft_pipapo_match *m) 
		}

	}



	gc = nft_trans_gc_catchall(gc, 0);

	gc = nft_trans_gc_catchall_sync(gc);

	if (gc) {

		nft_trans_gc_queue_sync_done(gc);

		priv->last_gc = jiffies;

net/netfilter/nft_set_rbtree.c

+1 −1
Original line number Diff line number Diff line
@@ -669,7 +669,7 @@ static void nft_rbtree_gc(struct work_struct *work) 
		nft_trans_gc_elem_add(gc, rbe);

	}



	gc = nft_trans_gc_catchall(gc, gc_seq);

	gc = nft_trans_gc_catchall_async(gc, gc_seq);



try_later:

	read_unlock_bh(&priv->lock);