From: Jiayuan Chen <jiayuan.chen@linux.dev>
To: netfilter-devel@vger.kernel.org
Subject: [PATCH nf-next v2 3/3] netfilter: bridge: annotate data-races around br_netfilter and nf_log sysctls
Date: Sun, 15 Nov 2026 23:03:42 +0800 [thread overview]
Message-ID: <20261115150342.86521-3-jiayuan.chen@linux.dev> (raw)
In-Reply-To: <20261115150342.86521-1-jiayuan.chen@linux.dev>
bridge-nf-call-arptables, bridge-nf-call-iptables,
bridge-nf-call-ip6tables, bridge-nf-filter-vlan-tagged,
bridge-nf-filter-pppoe-tagged, bridge-nf-pass-vlan-input-dev and
nf_log_all_netns are read in the packet path without any lock while their
sysctl handlers update them, and brnf_sysctl_call_tables() normalizes the
value with a plain write. Add READ_ONCE() to the readers and WRITE_ONCE()
to that handler.
KCSAN reports it when bridge-nf-call-iptables is changed while packets
are bridged:
BUG: KCSAN: data-race in br_nf_pre_routing / do_proc_int_conv
write (marked) to 0xffff8d7242d8ec50 of 4 bytes by task 824 on cpu 0:
do_proc_int_conv+0xa9/0xd0
proc_vec_conv+0x21/0x40
proc_vec+0x21e/0x6f0
proc_dointvec+0x16/0x30
brnf_sysctl_call_tables+0x19/0x70
proc_sys_call_handler+0x282/0x3a0
proc_sys_write+0x13/0x20
...
read to 0xffff8d7242d8ec50 of 4 bytes by interrupt on cpu 1:
br_nf_pre_routing+0x1a9/0x9d0
br_handle_frame+0x523/0x990
__netif_receive_skb_core.constprop.0+0x3b2/0x1cf0
__netif_receive_skb_one_core+0x51/0xe0
__netif_receive_skb+0x23/0xb0
process_backlog+0x27a/0x950
...
value changed: 0x00000001 -> 0x00000000
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
v1: https://lore.kernel.org/netdev/20261109025425.328445-1-jiayuan.chen@linux.dev/
Split out of the net-next series and sent to nf-next separately.
Also annotate the read in brnf_sysctl_call_tables().
---
net/bridge/br_netfilter_hooks.c | 22 +++++++++++-----------
net/bridge/netfilter/ebt_log.c | 2 +-
net/netfilter/nf_log_syslog.c | 2 +-
3 files changed, 13 insertions(+), 13 deletions(-)
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index e15355ff215a7..858c7fc43bde6 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -94,7 +94,7 @@ static inline bool is_vlan_ip(const struct sk_buff *skb, const struct net *net)
{
struct brnf_net *brnet = net_generic(net, brnf_net_id);
- return vlan_proto(skb) == htons(ETH_P_IP) && brnet->filter_vlan_tagged;
+ return vlan_proto(skb) == htons(ETH_P_IP) && READ_ONCE(brnet->filter_vlan_tagged);
}
static inline bool is_vlan_ipv6(const struct sk_buff *skb,
@@ -103,14 +103,14 @@ static inline bool is_vlan_ipv6(const struct sk_buff *skb,
struct brnf_net *brnet = net_generic(net, brnf_net_id);
return vlan_proto(skb) == htons(ETH_P_IPV6) &&
- brnet->filter_vlan_tagged;
+ READ_ONCE(brnet->filter_vlan_tagged);
}
static inline bool is_vlan_arp(const struct sk_buff *skb, const struct net *net)
{
struct brnf_net *brnet = net_generic(net, brnf_net_id);
- return vlan_proto(skb) == htons(ETH_P_ARP) && brnet->filter_vlan_tagged;
+ return vlan_proto(skb) == htons(ETH_P_ARP) && READ_ONCE(brnet->filter_vlan_tagged);
}
static inline __be16 pppoe_proto(const struct sk_buff *skb)
@@ -124,7 +124,7 @@ static inline bool is_pppoe_ip(const struct sk_buff *skb, const struct net *net)
struct brnf_net *brnet = net_generic(net, brnf_net_id);
return skb->protocol == htons(ETH_P_PPP_SES) &&
- pppoe_proto(skb) == htons(PPP_IP) && brnet->filter_pppoe_tagged;
+ pppoe_proto(skb) == htons(PPP_IP) && READ_ONCE(brnet->filter_pppoe_tagged);
}
static inline bool is_pppoe_ipv6(const struct sk_buff *skb,
@@ -134,7 +134,7 @@ static inline bool is_pppoe_ipv6(const struct sk_buff *skb,
return skb->protocol == htons(ETH_P_PPP_SES) &&
pppoe_proto(skb) == htons(PPP_IPV6) &&
- brnet->filter_pppoe_tagged;
+ READ_ONCE(brnet->filter_pppoe_tagged);
}
/* largest possible L2 header, see br_nf_dev_queue_xmit() */
@@ -442,7 +442,7 @@ static struct net_device *brnf_get_logical_dev(struct sk_buff *skb,
br = bridge_parent(dev);
- if (brnet->pass_vlan_indev == 0 || !skb_vlan_tag_present(skb))
+ if (READ_ONCE(brnet->pass_vlan_indev) == 0 || !skb_vlan_tag_present(skb))
return br;
vlan = __vlan_find_dev_deep_rcu(br, skb->vlan_proto,
@@ -502,7 +502,7 @@ static unsigned int br_nf_pre_routing(void *priv,
brnet = net_generic(state->net, brnf_net_id);
if (IS_IPV6(skb) || is_vlan_ipv6(skb, state->net) ||
is_pppoe_ipv6(skb, state->net)) {
- if (!brnet->call_ip6tables &&
+ if (!READ_ONCE(brnet->call_ip6tables) &&
!br_opt_get(br, BROPT_NF_CALL_IP6TABLES))
return NF_ACCEPT;
if (!ipv6_mod_enabled()) {
@@ -514,7 +514,7 @@ static unsigned int br_nf_pre_routing(void *priv,
return br_nf_pre_routing_ipv6(priv, skb, state);
}
- if (!brnet->call_iptables && !br_opt_get(br, BROPT_NF_CALL_IPTABLES))
+ if (!READ_ONCE(brnet->call_iptables) && !br_opt_get(br, BROPT_NF_CALL_IPTABLES))
return NF_ACCEPT;
if (!IS_IP(skb) && !is_vlan_ip(skb, state->net) &&
@@ -740,7 +740,7 @@ static unsigned int br_nf_forward_arp(struct sk_buff *skb,
br = p->br;
brnet = net_generic(state->net, brnf_net_id);
- if (!brnet->call_arptables && !br_opt_get(br, BROPT_NF_CALL_ARPTABLES))
+ if (!READ_ONCE(brnet->call_arptables) && !br_opt_get(br, BROPT_NF_CALL_ARPTABLES))
return NF_ACCEPT;
if (is_vlan_arp(skb, state->net))
@@ -1177,8 +1177,8 @@ int brnf_sysctl_call_tables(const struct ctl_table *ctl, int write,
ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
- if (write && *(int *)(ctl->data))
- *(int *)(ctl->data) = 1;
+ if (write && READ_ONCE(*(int *)(ctl->data)))
+ WRITE_ONCE(*(int *)(ctl->data), 1);
return ret;
}
diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index e2eea1daaf8ba..f360414a2814e 100644
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -79,7 +79,7 @@ ebt_log_packet(struct net *net, u_int8_t pf, unsigned int hooknum,
unsigned int bitmask;
/* FIXME: Disabled from containers until syslog ns is supported */
- if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns)
+ if (!net_eq(net, &init_net) && !READ_ONCE(sysctl_nf_log_all_netns))
return;
spin_lock_bh(&ebt_log_lock);
diff --git a/net/netfilter/nf_log_syslog.c b/net/netfilter/nf_log_syslog.c
index c3fd398ffcd77..2907f47c83423 100644
--- a/net/netfilter/nf_log_syslog.c
+++ b/net/netfilter/nf_log_syslog.c
@@ -43,7 +43,7 @@ struct arppayload {
/* Guard against containers flooding syslog. */
static bool nf_log_allowed(const struct net *net)
{
- return net_eq(net, &init_net) || sysctl_nf_log_all_netns;
+ return net_eq(net, &init_net) || READ_ONCE(sysctl_nf_log_all_netns);
}
static void nf_log_dump_vlan(struct nf_log_buf *m, const struct sk_buff *skb)
--
2.43.0
prev parent reply other threads:[~2026-11-15 15:04 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-15 15:03 [PATCH nf-next v2 1/3] netfilter: conntrack: annotate data-races around conntrack sysctls Jiayuan Chen
2026-11-15 15:03 ` [PATCH nf-next v2 2/3] netfilter: conntrack: annotate data-races around timeout and tcp sysctls Jiayuan Chen
2026-11-15 15:03 ` Jiayuan Chen [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261115150342.86521-3-jiayuan.chen@linux.dev \
--to=jiayuan.chen@linux.dev \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.