mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-10-26 10:57:38 +08:00
Phil Sutter
d3950004ba
Handling of concurrent hook changes with a dump in progress was problematic in nfnl_hook_dump and entirely broken in nfnl_hook_dump_nat. Address all issues in a single patch to please the review LLM. Introduce sequence numbers in struct netns_nf to replace pointer value-based modification detection which may fail due to memory buffer reuse. This also eliminates the need for most manual cb->seq updates and excessive array index value checks. Since nat hook updates are protected by a different mutex than others, they have to bump their own sequence number. nfnl_hook_dump_nat therefore open-codes what nl_dump_check_consistent does but bumps cb->seq instead of setting NLM_F_DUMP_INTR flag. Dumps of many nat hooks was entirely broken since the array index was not (re)stored. Use cb->args[1] for that and make sure it is reset upon completion as the same dump may loop over multiple arrays of nat hooks. In nfnl_hook_dump, don't signal NLM_F_DUMP_INTR if nfnl_hook_entries_head returns error: This is a permanent condition which does not change during a dump. It is already caught by nfnl_hook_dump_start though, so should not happen anyway. In general, access ops array pointer values using READ_ONCE since they are assigned to using WRITE_ONCE. Avoid setting NLM_F_DUMP_INTR flag in garbage memory by calling nl_dump_check_consistent only for non-empty skbs. If not a single netlink message was created, nfnetlink code will take care of setting the flag. Fixes:e2cf17d377("netfilter: add new hook nfnl subsystem") Fixes:b010e2a4a9("netfilter: nfnetlink_hook: Dump nat type chains") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>