Commit bcd9e3c1 authored by Felix Fietkau's avatar Felix Fietkau Committed by Pablo Neira Ayuso
Browse files

netfilter: flowtable_offload: add missing locking 



nf_flow_table_block_setup and the driver TC_SETUP_FT call can modify the flow
block cb list while they are being traversed elsewhere, causing a crash.
Add a write lock around the calls to protect readers

Fixes: c29f74e0 ("netfilter: nf_flow_table: hardware offload support")
Reported-by: default avatarChad Monroe <chad.monroe@smartrg.com>
Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 6a66ce44

net/netfilter/nf_flow_table_offload.c

+4 −0
Original line number Diff line number Diff line
@@ -1098,6 +1098,7 @@ static int nf_flow_table_block_setup(struct nf_flowtable *flowtable, 
	struct flow_block_cb *block_cb, *next;

	int err = 0;



	down_write(&flowtable->flow_block_lock);

	switch (cmd) {

	case FLOW_BLOCK_BIND:

		list_splice(&bo->cb_list, &flowtable->flow_block.cb_list);
@@ -1112,6 +1113,7 @@ static int nf_flow_table_block_setup(struct nf_flowtable *flowtable, 
		WARN_ON_ONCE(1);

		err = -EOPNOTSUPP;

	}

	up_write(&flowtable->flow_block_lock);



	return err;

}
@@ -1168,7 +1170,9 @@ static int nf_flow_table_offload_cmd(struct flow_block_offload *bo, 


	nf_flow_table_block_offload_init(bo, dev_net(dev), cmd, flowtable,

					 extack);

	down_write(&flowtable->flow_block_lock);

	err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_FT, bo);

	up_write(&flowtable->flow_block_lock);

	if (err < 0)

		return err;