From: Sasha Levin <Alexander.Levin@microsoft.com>
To: "stable@vger.kernel.org" <stable@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Cc: Taehee Yoo <ap420073@gmail.com>,
Pablo Neira Ayuso <pablo@netfilter.org>,
Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL 4.14 11/37] netfilter: nf_tables: release chain in flushing set
Date: Mon, 1 Oct 2018 00:39:00 +0000 [thread overview]
Message-ID: <20181001003850.147107-11-alexander.levin@microsoft.com> (raw)
In-Reply-To: <20181001003850.147107-1-alexander.levin@microsoft.com>
From: Taehee Yoo <ap420073@gmail.com>
[ Upstream commit 7acfda539c0b9636a58bfee56abfb3aeee806d96 ]
When element of verdict map is deleted, the delete routine should
release chain. however, flush element of verdict map routine doesn't
release chain.
test commands:
%nft add table ip filter
%nft add chain ip filter c1
%nft add map ip filter map1 { type ipv4_addr : verdict \; }
%nft add element ip filter map1 { 1 : jump c1 }
%nft flush map ip filter map1
%nft flush ruleset
splat looks like:
[ 4895.170899] kernel BUG at net/netfilter/nf_tables_api.c:1415!
[ 4895.178114] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
[ 4895.178880] CPU: 0 PID: 1670 Comm: nft Not tainted 4.18.0+ #55
[ 4895.178880] RIP: 0010:nf_tables_chain_destroy.isra.28+0x39/0x220 [nf_tables]
[ 4895.178880] Code: fc ff df 53 48 89 fb 48 83 c7 50 48 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 09 3c 03 7f 05 e8 3e 4c 25 e1 8b 43 50 85 c0 74 02 <0f> 0b 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02
[ 4895.228342] RSP: 0018:ffff88010b98f4c0 EFLAGS: 00010202
[ 4895.234841] RAX: 0000000000000001 RBX: ffff8801131c6968 RCX: ffff8801146585b0
[ 4895.234841] RDX: 1ffff10022638d37 RSI: ffff8801191a9348 RDI: ffff8801131c69b8
[ 4895.234841] RBP: ffff8801146585a8 R08: 1ffff1002323526a R09: 0000000000000000
[ 4895.234841] R10: 0000000000000000 R11: 0000000000000000 R12: dead000000000200
[ 4895.234841] R13: dead000000000100 R14: ffffffffa3638af8 R15: dffffc0000000000
[ 4895.234841] FS: 00007f6d188e6700(0000) GS:ffff88011b600000(0000) knlGS:0000000000000000
[ 4895.234841] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4895.234841] CR2: 00007ffe72b8df88 CR3: 000000010e2d4000 CR4: 00000000001006f0
[ 4895.234841] Call Trace:
[ 4895.234841] nf_tables_commit+0x2704/0x2c70 [nf_tables]
[ 4895.234841] ? nfnetlink_rcv_batch+0xa4f/0x11b0 [nfnetlink]
[ 4895.234841] ? nf_tables_setelem_notify.constprop.48+0x1a0/0x1a0 [nf_tables]
[ 4895.323824] ? __lock_is_held+0x9d/0x130
[ 4895.323824] ? kasan_unpoison_shadow+0x30/0x40
[ 4895.333299] ? kasan_kmalloc+0xa9/0xc0
[ 4895.333299] ? kmem_cache_alloc_trace+0x2c0/0x310
[ 4895.333299] ? nfnetlink_rcv_batch+0xa4f/0x11b0 [nfnetlink]
[ 4895.333299] nfnetlink_rcv_batch+0xdb9/0x11b0 [nfnetlink]
[ 4895.333299] ? debug_show_all_locks+0x290/0x290
[ 4895.333299] ? nfnetlink_net_init+0x150/0x150 [nfnetlink]
[ 4895.333299] ? sched_clock_cpu+0xe5/0x170
[ 4895.333299] ? sched_clock_local+0xff/0x130
[ 4895.333299] ? sched_clock_cpu+0xe5/0x170
[ 4895.333299] ? find_held_lock+0x39/0x1b0
[ 4895.333299] ? sched_clock_local+0xff/0x130
[ 4895.333299] ? memset+0x1f/0x40
[ 4895.333299] ? nla_parse+0x33/0x260
[ 4895.333299] ? ns_capable_common+0x6e/0x110
[ 4895.333299] nfnetlink_rcv+0x2c0/0x310 [nfnetlink]
[ ... ]
Fixes: 591054469b3e ("netfilter: nf_tables: revisit chain/object refcounting from elements")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
net/netfilter/nf_tables_api.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 742aacb317e5..3ae365f92bff 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4250,6 +4250,7 @@ static int nft_flush_set(const struct nft_ctx *ctx,
}
set->ndeact++;
+ nft_set_elem_deactivate(ctx->net, set, elem);
nft_trans_elem_set(trans) = set;
nft_trans_elem(trans) = *elem;
list_add_tail(&trans->list, &ctx->net->nft.commit_list);
--
2.17.1
next prev parent reply other threads:[~2018-10-01 0:48 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-01 0:38 [PATCH AUTOSEL 4.14 01/37] netfilter: xt_cluster: add dependency on conntrack module Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.14 02/37] HID: add support for Apple Magic Keyboards Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.14 03/37] usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i] Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.14 05/37] HID: hid-saitek: Add device ID for RAT 7 Contagion Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.14 04/37] pinctrl: msm: Really mask level interrupts to prevent latching Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.14 06/37] scsi: iscsi: target: Set conn->sess to NULL when iscsi_login_set_conn_values fails Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.14 07/37] scsi: qedi: Add the CRC size within iSCSI NVM image Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.14 08/37] perf evsel: Fix potential null pointer dereference in perf_evsel__new_idx() Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.14 09/37] perf util: Fix bad memory access in trace info Sasha Levin
2018-10-01 0:38 ` [PATCH AUTOSEL 4.14 10/37] perf probe powerpc: Ignore SyS symbols irrespective of endianness Sasha Levin
2018-10-01 0:39 ` Sasha Levin [this message]
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 12/37] Revert "iio: temperature: maxim_thermocouple: add MAX31856 part" Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 13/37] RDMA/ucma: check fd type in ucma_migrate_id() Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 14/37] HID: sensor-hub: Restore fixup for Lenovo ThinkPad Helix 2 sensor hub report Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 15/37] USB: yurex: Check for truncation in yurex_read() Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 16/37] nvmet-rdma: fix possible bogus dereference under heavy load Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 17/37] net/mlx5: Consider PCI domain in search for next dev Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 18/37] drm/nouveau/TBDdevinit: don't fail when PMU/PRE_OS is missing from VBIOS Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 20/37] dm raid: fix rebuild of specific devices by updating superblock Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 19/37] drm/nouveau/disp: fix DP disable race Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 21/37] fs/cifs: suppress a string overflow warning Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 22/37] net: ena: fix driver when PAGE_SIZE == 64kB Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 23/37] net: ena: fix missing calls to READ_ONCE Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 25/37] dm thin metadata: try to avoid ever aborting transactions Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 24/37] perf/x86/intel: Add support/quirk for the MISPREDICT bit on Knights Landing CPUs Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 26/37] netfilter: conntrack: timeout interface depend on CONFIG_NF_CONNTRACK_TIMEOUT Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 28/37] hexagon: modify ffs() and fls() to return int Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 27/37] arch/hexagon: fix kernel/dma.c build warning Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 29/37] arm64: jump_label.h: use asm_volatile_goto macro instead of "asm goto" Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 30/37] drm/amdgpu: fix error handling in amdgpu_cs_user_fence_chunk Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 31/37] r8169: Clear RTL_FLAG_TASK_*_PENDING when clearing RTL_FLAG_TASK_ENABLED Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 32/37] s390/qeth: use vzalloc for QUERY OAT buffer Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 33/37] s390/qeth: don't dump past end of unknown HW header Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 34/37] cifs: read overflow in is_valid_oplock_break() Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 35/37] xen/manage: don't complain about an empty value in control/sysrq node Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 37/37] xen: fix GCC warning and remove duplicate EVTCHN_ROW/EVTCHN_COL usage Sasha Levin
2018-10-01 0:39 ` [PATCH AUTOSEL 4.14 36/37] xen: avoid crash in disable_hotplug_cpu Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181001003850.147107-11-alexander.levin@microsoft.com \
--to=alexander.levin@microsoft.com \
--cc=ap420073@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®