Re: [PATCH nf-next] netfilter: nf_table_offload: Fix the incorrect rcu usage in nft_indr_block_get_and_ing_cmd

[Florian Westphal <fw@strlen.de>]

wenxu <wenxu@ucloud.cn> wrote:
> >> The nft_indr_block_get_and_ing_cmd is called in netdevice notify
> >> It is the incorrect rcu case, To fix it just traverse the list under
> >> the commit mutex.
> > What is an 'incorrect rcu case'?
> >
> > Please clarify, e.g. by including rcu warning/splat backtrace here.

[..]

> flow_block_ing_cmd() needs to call blocking functions while iterating block_ing_cb_list,
> nft_indr_block_get_and_ing_cmd is in the cb_list, So it should also not in rcu for blocking
> cases.

Please submit a v2 that includes this explanation in the commit message.

> >> +	struct nft_ctx ctx = {
> >> +		.net	= dev_net(dev),
> >> +	};
> > Why is this ctx needed?
> >
> >> +	mutex_lock(&ctx.net->nft.commit_mutex);
> > net->nft.commit_mutex?
> 
> When traverse the list, the list is protected under commit_mutex like nf_tables_netdev_event
> do in the netdevice notify callback

Yes, I see that, but why do you need nft_ctx ctx?  Its confusing.

Just use

mutex_lock(&net->nft.commit_mutex);

without adding this 'ctx'.