Commit cefa31a9 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_log: perform module load from nf_tables 



modprobe calls from the nf_logger_find_get() API causes deadlock in very
special cases because they occur with the nf_tables transaction mutex held.

In the specific case of nf_log, deadlock is via:

 A nf_tables -> transaction mutex -> nft_log -> modprobe -> nf_log_syslog \
	    -> pernet_ops rwsem -> wait for C
 B netlink event -> rtnl_mutex -> nf_tables transaction mutex -> wait for A
 C close() -> ip6mr_sk_done -> rtnl_mutex -> wait for B

Earlier patch added NFLOG/xt_LOG module softdeps to avoid the need to load
the backend module during a transaction.

For nft_log we would have to add a softdep for both nfnetlink_log or
nf_log_syslog, since we do not know in advance which of the two backends
are going to be configured.

This defers the modprobe op until after the transaction mutex is released.

Tested-by: default avatarPhil Sutter <phil@nwl.cc>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent a38b5b56

include/net/netfilter/nf_tables.h

+5 −0
Original line number Diff line number Diff line
@@ -1562,4 +1562,9 @@ void nf_tables_trans_destroy_flush_work(void); 
int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result);

__be64 nf_jiffies64_to_msecs(u64 input);



#ifdef CONFIG_MODULES

__printf(2, 3) int nft_request_module(struct net *net, const char *fmt, ...);

#else

static inline int nft_request_module(struct net *net, const char *fmt, ...) { return -ENOENT; }

#endif

#endif /* _NET_NF_TABLES_H */

net/netfilter/nf_log.c

+0 −3
Original line number Diff line number Diff line
@@ -170,9 +170,6 @@ int nf_logger_find_get(int pf, enum nf_log_type type) 
		return 0;

	}



	if (rcu_access_pointer(loggers[pf][type]) == NULL)

		request_module("nf-logger-%u-%u", pf, type);



	rcu_read_lock();

	logger = rcu_dereference(loggers[pf][type]);

	if (logger == NULL)

net/netfilter/nf_tables_api.c

+3 −2
Original line number Diff line number Diff line
@@ -586,7 +586,7 @@ struct nft_module_request { 
};



#ifdef CONFIG_MODULES

static __printf(2, 3) int nft_request_module(struct net *net, const char *fmt,

__printf(2, 3) int nft_request_module(struct net *net, const char *fmt,

				      ...)

{

	char module_name[MODULE_NAME_LEN];
@@ -620,6 +620,7 @@ static __printf(2, 3) int nft_request_module(struct net *net, const char *fmt, 


	return -EAGAIN;

}

EXPORT_SYMBOL_GPL(nft_request_module);

#endif



static void lockdep_nfnl_nft_mutex_not_held(void)

net/netfilter/nft_log.c

+19 −1
Original line number Diff line number Diff line
@@ -128,6 +128,20 @@ static const struct nla_policy nft_log_policy[NFTA_LOG_MAX + 1] = { 
	[NFTA_LOG_FLAGS]	= { .type = NLA_U32 },

};



static int nft_log_modprobe(struct net *net, enum nf_log_type t)

{

	switch (t) {

	case NF_LOG_TYPE_LOG:

		return nft_request_module(net, "%s", "nf_log_syslog");

	case NF_LOG_TYPE_ULOG:

		return nft_request_module(net, "%s", "nfnetlink_log");

	case NF_LOG_TYPE_MAX:

		break;

	}



	return -ENOENT;

}



static int nft_log_init(const struct nft_ctx *ctx,

			const struct nft_expr *expr,

			const struct nlattr * const tb[])
@@ -197,8 +211,12 @@ static int nft_log_init(const struct nft_ctx *ctx, 
		return 0;



	err = nf_logger_find_get(ctx->family, li->type);

	if (err < 0)

	if (err < 0) {

		if (nft_log_modprobe(ctx->net, li->type) == -EAGAIN)

			err = -EAGAIN;



		goto err1;

	}



	return 0;