From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f174.google.com (mail-qt1-f174.google.com [209.85.160.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 24F7B335BDB for ; Fri, 17 Jul 2026 19:45:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784317515; cv=none; b=qmJVOc3WQHGPolfaVFyp8zRX/tkbsaXbpdsGhHNST/7JKjTV8O/MWp59WY5sTQvw1KH/9F+tvsYYs8qL6pHOXxlhtEiJoidoGyCgi1ydVOJketTHjdGpoLfiB9FDTbuPQa1Yal28y4sYTKTQrF2ZR6vJ96Gh4LAzYF1BwQFItnw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784317515; c=relaxed/simple; bh=RxkvEXDx8KlyCHd2+X+HZ/CkG1k2fbI1E4IJ9wEZVew=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=HF3GNHScYmpnrBYDnBk3IlNSI7aIZatdCkpAoWIvgxcUt4eOhEtEkKXq6jb0kJ8Gz/uQx9H5fndw3USrA2eD+dfOoC4j84SAg2vHVaJTYia6g38FXqOuQZxkQCZnxwjVbiwe32VL3eL7KRJNC300Pxlt/G4zQ0bNW0Gddu+Apxg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=AtRcqkAs; arc=none smtp.client-ip=209.85.160.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="AtRcqkAs" Received: by mail-qt1-f174.google.com with SMTP id d75a77b69052e-51bf2479349so73296601cf.2 for ; Fri, 17 Jul 2026 12:45:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784317512; x=1784922312; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=40Iwwbwi3zfzgUmW087PtCRLpD5oHv9m7czWAQxS6Q0=; b=AtRcqkAscq9IJlcXd6onOKWeR6ZsfZf02iDmtSlNGJtV1pgonpzHcTAI9JMxN+gti1 2dzLx2zksI3oaj0V/lJDY30K50FxU1TDMv4Pqwh9GHN3Nfx6B+lZN7RTCORX+YP6VjJT cAZTmTb22fDsySjJoosrG7w8rf92yrtpK03fmNgrPR591VtiMm+Q5AI93xis5H+h0hcn 6Vw9+TY8SKyQrUg0YzH4hh83lO+r2i+umE4sr2jh110cgDfF7YyaxLhiAhspkRNFRwlx Jo7NX1xS5VRuV4upfXRcGQkzKp7GUjxrWhJFxwPqaa6Q0ZxN1Sjh4nIvm6v7yBok67Yb N3iw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784317512; x=1784922312; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=40Iwwbwi3zfzgUmW087PtCRLpD5oHv9m7czWAQxS6Q0=; b=oATTkOrN/Rs2NQHKjenLddFbMa+icyibuWiSuINpRwfMUCgRtYlZU/koM6r69Cq29r Ro3vBGxersotMO4iHRe4NEYVbOwdog3PsEeS6DgJtgqU9Q2lLguN8geiObX/04hOMMEi /oXEBGXXSHR8PuF9ayFS05VJjCZ+bUBfxhLQpCjOuK5ejbVuQ2pGT2lXuGFhfR3N2Ec3 IvBpUOuW/mxT/AZwu/3ho2+0jRTtXDkBiuJuDyHHtK8F6q1fki2RW0SKHvNz8SPGDjfE /Qq2noWVqV7BaGPJhpwnVlKYlLX3Cbs6QB5+fmpPnlUx2RBjEjgYHJbqUVlwPfvbP30q gzSA== X-Forwarded-Encrypted: i=1; AHgh+RodNA8q6UwYeQQQUNwOx5AtWGS6RFk06h9m9i9bmxnj0EUAIdn/3A0aRn8f3o5+uozUNUIDxswgmX32mFE=@vger.kernel.org X-Gm-Message-State: AOJu0YyoTXjsYHKnRVE+67o/+SlPef3eewXqb9IzSl7gTTrUYJWV5XRQ dRIMDHUHpBg8jEG4c8fTYJ3DgmID/jo2sKIiTJpyN22qOo6q6ph92Smg X-Gm-Gg: AfdE7cnyTBgpgjh4h3TR6Jn1AiNHFf6LlCSCQoQvJWts0k0IMVSacZqmuSXjic7vvOO 6Z839r0SHJ2wvGvp/UkV8gJTSTRwcHripJQlaVVCogFou+jgWlR3jenpVZh3u10DL0RUOBAVs+2 bIoO15Boxdyxcnmhli9Ur1qo0ul3EHAbv9Fnw8gix4sQ6Pc/lCLs33+ArAbaaTRXW3jn0m8A2oy 23KZDIijrxSXjD4Id4NLarXlZic5aolqGZZbLbq/N9/9OmmXFpgww9B39ILI3rLysBJWmNggWln 4ji987KbEB9k7mENh6tWO3xgCuFPOi8E5M/eSUG7YJS45Zn0ossTSTao4tCR2PDpdIw2PpqTFXp ecGWJ9sBM+5hAVOaEyLj+Do97mVaZ6AAIgMw9fSevLUlayJrB0Y3uMrbOp5hjViGCgSt2gr+h8V Gr7AKNRfqn/sCniefkvaLrpauAfnVIRH4= X-Received: by 2002:a05:622a:1:b0:517:6b9c:58e4 with SMTP id d75a77b69052e-5213e28ff1fmr41926781cf.51.1784317511770; Fri, 17 Jul 2026 12:45:11 -0700 (PDT) Received: from i4-l-hqh5357-03.ad.psu.edu ([130.203.139.71]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-5214f5fb88esm19766811cf.21.2026.07.17.12.45.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jul 2026 12:45:11 -0700 (PDT) From: Shuangpeng Bai To: davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: horms@kernel.org, elic@nvidia.com, jiri@resnulli.us, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Shuangpeng Bai , stable@vger.kernel.org Subject: [PATCH] net: flow_offload: clean up indirect flow block on bind failure Date: Fri, 17 Jul 2026 15:44:55 -0400 Message-ID: <20260717194455.1734974-1-shuangpeng.kernel@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit flow_indr_dev_setup_offload() records FLOW_BLOCK_BIND requests in flow_indir_dev_list before it calls registered indirect providers. When no registered provider binds the block, it returns -EOPNOTSUPP. The replay entry is left behind. One affected path is nftables netdev offload. A netdev base chain on a device without ndo_setup_tc can take the indirect path if an indirect provider is registered. If none of the registered providers binds the block, the operation fails with -EOPNOTSUPP. The failed NEWCHAIN transaction can then abort and free the nft_base_chain, while the replay entry still points at that basechain and its flow_block cb_list. If another provider is registered later, the stale entry is replayed, potentially passing freed data to the provider callback or splicing callback entries into freed memory. Use the return value of indir_dev_add() only to track ownership of the replay entry. Preserve the existing behavior of not propagating -EEXIST or -ENOMEM. If this invocation inserted an entry, remove it again when the bind fails. Fixes: 74fc4f828769 ("net: Fix offloading indirect devices dependency on qdisc order creation") Cc: stable@vger.kernel.org Signed-off-by: Shuangpeng Bai --- net/core/flow_offload.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/net/core/flow_offload.c b/net/core/flow_offload.c index 5071d7fe6ce2..5fbb1ae4679d 100644 --- a/net/core/flow_offload.c +++ b/net/core/flow_offload.c @@ -606,15 +606,20 @@ int flow_indr_dev_setup_offload(struct net_device *dev, struct Qdisc *sch, void (*cleanup)(struct flow_block_cb *block_cb)) { struct flow_indr_dev *this; + bool replay_added = false; u32 count = 0; int err; mutex_lock(&flow_indr_block_lock); if (bo) { - if (bo->command == FLOW_BLOCK_BIND) - indir_dev_add(data, dev, sch, type, cleanup, bo); - else if (bo->command == FLOW_BLOCK_UNBIND) + if (bo->command == FLOW_BLOCK_BIND) { + int add_err; + + add_err = indir_dev_add(data, dev, sch, type, cleanup, bo); + replay_added = add_err == 0; + } else if (bo->command == FLOW_BLOCK_UNBIND) { indir_dev_remove(data); + } } list_for_each_entry(this, &flow_block_indr_dev_list, list) { @@ -623,9 +628,17 @@ int flow_indr_dev_setup_offload(struct net_device *dev, struct Qdisc *sch, count++; } + if (bo && list_empty(&bo->cb_list)) { + if (replay_added) + indir_dev_remove(data); + err = -EOPNOTSUPP; + } else { + err = count; + } + mutex_unlock(&flow_indr_block_lock); - return (bo && list_empty(&bo->cb_list)) ? -EOPNOTSUPP : count; + return err; } EXPORT_SYMBOL(flow_indr_dev_setup_offload); -- 2.43.0