All of lore.kernel.org
 help / color / mirror / Atom feed
From: Florian Westphal <fw@strlen.de>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH nf] netfilter: nf_tables: reject duplicate device on updates
Date: Wed, 13 Aug 2025 08:36:07 +0200	[thread overview]
Message-ID: <aJwyV7P5fqiENxB-@strlen.de> (raw)
In-Reply-To: <20250813003850.1360-1-pablo@netfilter.org>

Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> A chain/flowtable update with duplicated devices in the same batch is
> possible. Unfortunately, netdev event path only removes the first
> device that is found, leaving unregistered the hook of the duplicated
> device.
> 
> Check if a duplicated device exists in the transaction batch, bail out
> with EEXIST in such case.
> 
> WARNING is hit when unregistering the hook:
> 
>  [49042.221275] WARNING: CPU: 4 PID: 8425 at net/netfilter/core.c:340 nf_hook_entry_head+0xaa/0x150
>  [49042.221375] CPU: 4 UID: 0 PID: 8425 Comm: nft Tainted: G S                  6.16.0+ #170 PREEMPT(full)
>  [...]
>  [49042.221382] RIP: 0010:nf_hook_entry_head+0xaa/0x150

Thanks Pablo.

Just to confirm: this doesn't result in anything other than
the unreg splat, correct?

Or does this leak memory too?

FTR, i placed this in nf.git:testing.

  reply	other threads:[~2025-08-13  6:36 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-08-13  0:38 [PATCH nf] netfilter: nf_tables: reject duplicate device on updates Pablo Neira Ayuso
2025-08-13  6:36 ` Florian Westphal [this message]
2025-08-13 13:07   ` Pablo Neira Ayuso

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=aJwyV7P5fqiENxB-@strlen.de \
    --to=fw@strlen.de \
    --cc=netfilter-devel@vger.kernel.org \
    --cc=pablo@netfilter.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.