From: Sasha Levin <Alexander.Levin@microsoft.com>
To: "stable@vger.kernel.org" <stable@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: Taehee Yoo <ap420073@gmail.com>,
Pablo Neira Ayuso <pablo@netfilter.org>,
Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL 4.18 17/65] netfilter: nf_tables: release chain in flushing set
Date: Mon, 1 Oct 2018 00:38:13 +0000 [thread overview]
Message-ID: <20181001003754.146961-17-alexander.levin@microsoft.com> (raw)
In-Reply-To: <20181001003754.146961-1-alexander.levin@microsoft.com>
From: Taehee Yoo <ap420073@gmail.com>
[ Upstream commit 7acfda539c0b9636a58bfee56abfb3aeee806d96 ]
When element of verdict map is deleted, the delete routine should
release chain. however, flush element of verdict map routine doesn't
release chain.
test commands:
%nft add table ip filter
%nft add chain ip filter c1
%nft add map ip filter map1 { type ipv4_addr : verdict \; }
%nft add element ip filter map1 { 1 : jump c1 }
%nft flush map ip filter map1
%nft flush ruleset
splat looks like:
[ 4895.170899] kernel BUG at net/netfilter/nf_tables_api.c:1415!
[ 4895.178114] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
[ 4895.178880] CPU: 0 PID: 1670 Comm: nft Not tainted 4.18.0+ #55
[ 4895.178880] RIP: 0010:nf_tables_chain_destroy.isra.28+0x39/0x220 [nf_tables]
[ 4895.178880] Code: fc ff df 53 48 89 fb 48 83 c7 50 48 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 09 3c 03 7f 05 e8 3e 4c 25 e1 8b 43 50 85 c0 74 02 <0f> 0b 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02
[ 4895.228342] RSP: 0018:ffff88010b98f4c0 EFLAGS: 00010202
[ 4895.234841] RAX: 0000000000000001 RBX: ffff8801131c6968 RCX: ffff8801146585b0
[ 4895.234841] RDX: 1ffff10022638d37 RSI: ffff8801191a9348 RDI: ffff8801131c69b8
[ 4895.234841] RBP: ffff8801146585a8 R08: 1ffff1002323526a R09: 0000000000000000
[ 4895.234841] R10: 0000000000000000 R11: 0000000000000000 R12: dead000000000200
[ 4895.234841] R13: dead000000000100 R14: ffffffffa3638af8 R15: dffffc0000000000
[ 4895.234841] FS: 00007f6d188e6700(0000) GS:ffff88011b600000(0000) knlGS:0000000000000000
[ 4895.234841] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4895.234841] CR2: 00007ffe72b8df88 CR3: 000000010e2d4000 CR4: 00000000001006f0
[ 4895.234841] Call Trace:
[ 4895.234841] nf_tables_commit+0x2704/0x2c70 [nf_tables]
[ 4895.234841] ? nfnetlink_rcv_batch+0xa4f/0x11b0 [nfnetlink]
[ 4895.234841] ? nf_tables_setelem_notify.constprop.48+0x1a0/0x1a0 [nf_tables]
[ 4895.323824] ? __lock_is_held+0x9d/0x130
[ 4895.323824] ? kasan_unpoison_shadow+0x30/0x40
[ 4895.333299] ? kasan_kmalloc+0xa9/0xc0
[ 4895.333299] ? kmem_cache_alloc_trace+0x2c0/0x310
[ 4895.333299] ? nfnetlink_rcv_batch+0xa4f/0x11b0 [nfnetlink]
[ 4895.333299] nfnetlink_rcv_batch+0xdb9/0x11b0 [nfnetlink]
[ 4895.333299] ? debug_show_all_locks+0x290/0x290
[ 4895.333299] ? nfnetlink_net_init+0x150/0x150 [nfnetlink]
[ 4895.333299] ? sched_clock_cpu+0xe5/0x170
[ 4895.333299] ? sched_clock_local+0xff/0x130
[ 4895.333299] ? sched_clock_cpu+0xe5/0x170
[ 4895.333299] ? find_held_lock+0x39/0x1b0
[ 4895.333299] ? sched_clock_local+0xff/0x130
[ 4895.333299] ? memset+0x1f/0x40
[ 4895.333299] ? nla_parse+0x33/0x260
[ 4895.333299] ? ns_capable_common+0x6e/0x110
[ 4895.333299] nfnetlink_rcv+0x2c0/0x310 [nfnetlink]
[ ... ]
Fixes: 591054469b3e ("netfilter: nf_tables: revisit chain/object refcounting from elements")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
net/netfilter/nf_tables_api.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index f5745e4c6513..77d690a87144 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4582,6 +4582,7 @@ static int nft_flush_set(const struct nft_ctx *ctx,
}
set->ndeact++;
+ nft_set_elem_deactivate(ctx->net, set, elem);
nft_trans_elem_set(trans) = set;
nft_trans_elem(trans) = *elem;
list_add_tail(&trans->list, &ctx->net->nft.commit_list);
--
2.17.1
next prev parent reply other threads:[~2018-10-01 0:53 UTC|newest]
Thread overview: 67+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-01 0:38 [PATCH AUTOSEL 4.18 01/65] netfilter: xt_cluster: add dependency on conntrack module Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 02/65] netfilter: xt_checksum: ignore gso skbs Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 03/65] HID: intel-ish-hid: Enable Sunrise Point-H ish driver Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 05/65] usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i] Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 04/65] HID: add support for Apple Magic Keyboards Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 06/65] pinctrl: msm: Really mask level interrupts to prevent latching Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 07/65] HID: hid-saitek: Add device ID for RAT 7 Contagion Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 09/65] scsi: iscsi: target: Fix conn_ops double free Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 08/65] scsi: iscsi: target: Set conn->sess to NULL when iscsi_login_set_conn_values fails Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 10/65] scsi: qedi: Add the CRC size within iSCSI NVM image Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 11/65] perf annotate: Properly interpret indirect call Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 13/65] perf util: Fix bad memory access in trace info Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 12/65] perf evsel: Fix potential null pointer dereference in perf_evsel__new_idx() Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 14/65] perf probe powerpc: Ignore SyS symbols irrespective of endianness Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 15/65] perf annotate: Fix parsing aarch64 branch instructions after objdump update Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 16/65] netfilter: kconfig: nat related expression depend on nftables core Sasha Levin
2018-10-01 0:38 ` Sasha Levin [this message]
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 19/65] iio: imu: st_lsm6dsx: take into account ts samples in wm configuration Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 18/65] Revert "iio: temperature: maxim_thermocouple: add MAX31856 part" Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 21/65] riscv: Do not overwrite initrd_start and initrd_end Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 20/65] RDMA/ucma: check fd type in ucma_migrate_id() Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 22/65] HID: sensor-hub: Restore fixup for Lenovo ThinkPad Helix 2 sensor hub report Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 23/65] usb: host: xhci-plat: Iterate over parent nodes for finding quirks Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 24/65] USB: yurex: Check for truncation in yurex_read() Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 25/65] nvmet-rdma: fix possible bogus dereference under heavy load Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 26/65] bnxt_re: Fix couple of memory leaks that could lead to IOMMU call traces Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 27/65] net/mlx5: Consider PCI domain in search for next dev Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 29/65] dm raid: fix reshape race on small devices Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 28/65] HID: i2c-hid: Don't reset device upon system resume Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 30/65] drm/nouveau: fix oops in client init failure path Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 31/65] drm/nouveau/mmu: don't attempt to dereference vmm without valid instance pointer Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 32/65] drm/nouveau/TBDdevinit: don't fail when PMU/PRE_OS is missing from VBIOS Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 33/65] drm/nouveau/disp: fix DP disable race Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 34/65] drm/nouveau/disp/gm200-: enforce identity-mapped SOR assignment for LVDS/eDP panels Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 35/65] dm raid: fix stripe adding reshape deadlock Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 37/65] dm raid: fix RAID leg rebuild errors Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 36/65] dm raid: fix rebuild of specific devices by updating superblock Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 38/65] r8169: set TxConfig register after TX / RX is enabled, just like RxConfig Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 39/65] fs/cifs: suppress a string overflow warning Sasha Levin
2018-10-01 1:22 ` Stephen Rothwell
2018-10-01 23:48 ` Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 40/65] net: ena: fix surprise unplug NULL dereference kernel crash Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 42/65] net: ena: fix device destruction to gracefully free resources Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 41/65] net: ena: fix driver when PAGE_SIZE == 64kB Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 44/65] net: ena: fix missing lock during device destruction Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 43/65] net: ena: fix potential double ena_destroy_device() Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 45/65] net: ena: fix missing calls to READ_ONCE Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 46/65] perf/x86/intel: Add support/quirk for the MISPREDICT bit on Knights Landing CPUs Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 47/65] sched/topology: Set correct NUMA topology type Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 49/65] netfilter: conntrack: timeout interface depend on CONFIG_NF_CONNTRACK_TIMEOUT Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 48/65] dm thin metadata: try to avoid ever aborting transactions Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 50/65] netfilter: nfnetlink_queue: Solve the NFQUEUE/conntrack clash for NF_REPEAT Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 51/65] netfilter: xt_hashlimit: use s->file instead of s->private Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 52/65] arch/hexagon: fix kernel/dma.c build warning Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 54/65] drm/amdgpu: Fix SDMA hang in prt mode v2 Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 53/65] hexagon: modify ffs() and fls() to return int Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 56/65] drm/amdgpu: fix error handling in amdgpu_cs_user_fence_chunk Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 55/65] arm64: jump_label.h: use asm_volatile_goto macro instead of "asm goto" Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 57/65] r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 59/65] s390/qeth: don't dump past end of unknown HW header Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 58/65] s390/qeth: use vzalloc for QUERY OAT buffer Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 61/65] asm-generic: io: Fix ioport_map() for !CONFIG_GENERIC_IOMAP && CONFIG_INDIRECT_PIO Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 60/65] cifs: read overflow in is_valid_oplock_break() Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 62/65] xen/manage: don't complain about an empty value in control/sysrq node Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 64/65] xen: fix GCC warning and remove duplicate EVTCHN_ROW/EVTCHN_COL usage Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 63/65] xen: avoid crash in disable_hotplug_cpu Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.18 65/65] x86/APM: Fix build warning when PROC_FS is not enabled Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181001003754.146961-17-alexander.levin@microsoft.com \
--to=alexander.levin@microsoft.com \
--cc=ap420073@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome