]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
netfilter: nf_tables: can't schedule in nft_chain_validate
authorFlorian Westphal <fw@strlen.de>
Mon, 17 Jul 2023 23:30:33 +0000 (01:30 +0200)
committerFlorian Westphal <fw@strlen.de>
Thu, 20 Jul 2023 09:59:25 +0000 (11:59 +0200)
commit314c82841602a111c04a7210c21dc77e0d560242
tree095fdc2292624d8a34a93de89a70cea30c81c15a
parentddbd8be68941985f166f5107109a90ce13147c44
netfilter: nf_tables: can't schedule in nft_chain_validate

Can be called via nft set element list iteration, which may acquire
rcu and/or bh read lock (depends on set type).

BUG: sleeping function called from invalid context at net/netfilter/nf_tables_api.c:3353
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1232, name: nft
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
2 locks held by nft/1232:
 #0: ffff8881180e3ea8 (&nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid
 #1: ffffffff83f5f540 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire
Call Trace:
 nft_chain_validate
 nft_lookup_validate_setelem
 nft_pipapo_walk
 nft_lookup_validate
 nft_chain_validate
 nft_immediate_validate
 nft_chain_validate
 nf_tables_validate
 nf_tables_abort

No choice but to move it to nf_tables_validate().

Fixes: 81ea01066741 ("netfilter: nf_tables: add rescheduling points during loop detection walks")
Signed-off-by: Florian Westphal <fw@strlen.de>
net/netfilter/nf_tables_api.c