Re: [PATCH nf-next] netfilter: nf_tables: avoid chain re-validation if possible

[Florian Westphal <fw@strlen.de>]

Hamza Mahfooz <hamzamahfooz@linux.microsoft.com> wrote:
> The issue is reproducible with this version of the patch applied, unless
> I make the following change:
> 
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index 1cf9f0aa1f49..a7b415c53df6 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -4145,14 +4145,8 @@ int nft_chain_validate(const struct nft_ctx *ctx, struct nft_chain *chain)
>  	if (ctx->level == NFT_JUMP_STACK_SIZE)
>  		return -EMLINK;
>  
> -	if (ctx->level > 0) {
> -		/* jumps to base chains are not allowed. */
> -		if (nft_is_base_chain(chain))
> -			return -ELOOP;
> -
> -		if (nft_chain_vstate_valid(ctx, chain))
> -			return 0;
> -	}
> +	if (ctx->level && nft_chain_vstate_valid(ctx, chain))
> +		return 0;

Looks like a placebo change to me?
Also, the nft_is_base_chain(chain) check is required.

> It is also worth noting that I'm still seeing the cpu usage spike up to
> 100% for a couple of seconds (attributed to an iptables process) with
> this version of the patch (even with the above change), while the
> previous rendition seemd to have resolved that.

The previous version makes illegal shortcuts (as in, not validating
when it has to), it cannot be applied.

That said, I have flagged this patch as deferred anyway, there are too
many conflicting changes flying around.

I'll resubmit in a few weeks when -next opens up again.