From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oo1-f69.google.com (mail-oo1-f69.google.com [209.85.161.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 62D43274FE3 for ; Tue, 27 Jan 2026 21:05:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.69 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769547932; cv=none; b=G5RHBmN4rhV3BaWo1IyO1n2cFHIShQ/YR3B0lEXSuSQk9uOXsFtijkZyfDSbLacBJxnhvo1n5hpyY5HU4+ZKJUWuDi5IXiXleB64MbGUGCzQPIFlTCLFlZ6p82yXtTroAzOfiD3k9TCmM1TqvHpVvKqmWy2oyMS3LxshHztiv9Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769547932; c=relaxed/simple; bh=7VqG5hoQ4mbWs8rZX6D6vY5Gf61Lgm1AWHsVoyHk5sY=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To:Cc: Content-Type; b=XaaeMk87+fpVbiK270fcNxT3ahFWziHQj3PbM65CHwE9+4OTJw011TCm0Dhsjr8oX5vmIIL/iWAiZAkmQ5Z1AfRma3HQp8I3VmEmT3LKyzjoqMtR3C7p7B2UP48lFuI3nwo77QuAO4UM5I+51qZE2Rxuwhj9rF8XWszJcx+HT1g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f69.google.com with SMTP id 006d021491bc7-661066bdfb9so12471907eaf.1 for ; Tue, 27 Jan 2026 13:05:30 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769547929; x=1770152729; h=cc:to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=qRiK020Rn1+xFlFZlqdO/e8cAmwnND0yCM2CZn7roow=; b=pHtrXHNI+a7WtA7zLdxWWvQ2lNZuBAR0bMuBkQNi/oKsImfAFEQMfvwB8O5bqId1VS 8NmQ17zGuknLzlXokoBTVYlKLa9XHOVYdvRluCayAvwPH3R+jiNsIZnM9HghFBqg4Jpl a+tiQdbu7hqP7A4YmL/ToyYfXOvvjELFoAWNX1p9wtRk3lVPPHi568uLL0Z17kmHwaBa DM9x5lSWuDbnoEqI8Fp/jLZ1ollqSE4Ymu3eNcSjhRHjuuMBTK3CK6dYULBkg+Ud2k2A Wne/GwWeiEX83GCdC8/mhK3oDNv27A6Rt5VkHft8DnjfzIYuomjNOAkHn/DD23I4PJFa g2Xg== X-Forwarded-Encrypted: i=1; AJvYcCWpKWrZXmpINspMsKlvFLcxuiS/2S97ogbqGpatG5CGi9OBwZsOMugMWKlCepkydNUd+seX7tNLDhPY1g4=@vger.kernel.org X-Gm-Message-State: AOJu0YzxlolFRRYkJCeAdFqklhEHByZMdPATcRQxuC8hZNASS0BYPhe5 +m4sNZQJO6DbDLhD03R6L6jIqvOKf6NXYEuf7pOxaejtfS+uOexEJK9H/58TJifkF4hBFNsjdog fbmJ4nNIpoHZigZSr9NNGhyNC3SY8vH8D5bD9lQikoLjhCvpYXEBT6tJWFTA= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:810c:b0:662:c161:206e with SMTP id 006d021491bc7-662f20f24afmr1406598eaf.82.1769547929360; Tue, 27 Jan 2026 13:05:29 -0800 (PST) Date: Tue, 27 Jan 2026 13:05:29 -0800 In-Reply-To: <918683725.109285.1769547925955@ichabod.co-bxl> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <69792899.050a0220.c9109.0023.GAE@google.com> Subject: Re: test [PATCH nf-next] netfilter: nf_tables: use dedicated mutex for reset operations From: syzbot To: brianwitte@mailfence.com Cc: brianwitte@mailfence.com, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next.git main This crash does not have a reproducer. I cannot test it. > > From: Brian Witte > Subject: netfilter: nf_tables: use dedicated mutex for reset operations > > Add a dedicated reset_mutex to serialize reset operations instead of > reusing the commit_mutex. This fixes a circular locking dependency > between commit_mutex, nfnl_subsys_ipset, and nlk_cb_mutex-NETFILTER > that could lead to deadlock when nft reset, ipset list, and > iptables-nft with set match run concurrently: > > CPU0 (nft reset): nlk_cb_mutex -> commit_mutex > CPU1 (ipset list): nfnl_subsys_ipset -> nlk_cb_mutex > CPU2 (iptables -m set): commit_mutex -> nfnl_subsys_ipset > > The reset_mutex only serializes concurrent reset operations to prevent > counter underruns, which is all that's needed. Breaking the commit_mutex > dependency in the dump-reset path eliminates the circular lock chain. > > Reported-by: syzbot+ff16b505ec9152e5f448@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=ff16b505ec9152e5f448 > Signed-off-by: Brian Witte > --- > include/net/netfilter/nf_tables.h | 1 + > net/netfilter/nf_tables_api.c | 30 +++++++++++++++--------------- > 2 files changed, 16 insertions(+), 15 deletions(-) > > diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h > index 31906f90706e..85cdd93e564b 100644 > --- a/include/net/netfilter/nf_tables.h > +++ b/include/net/netfilter/nf_tables.h > @@ -1931,6 +1931,7 @@ struct nftables_pernet { > struct list_head module_list; > struct list_head notify_list; > struct mutex commit_mutex; > + struct mutex reset_mutex; > u64 table_handle; > u64 tstamp; > unsigned int gc_seq; > diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c > index be4924aeaf0e..c82b7875c49c 100644 > --- a/net/netfilter/nf_tables_api.c > +++ b/net/netfilter/nf_tables_api.c > @@ -3907,13 +3907,12 @@ static int nf_tables_dumpreset_rules(struct sk_buff *skb, > struct nftables_pernet *nft_net = nft_pernet(sock_net(skb->sk)); > int ret; > > - /* Mutex is held is to prevent that two concurrent dump-and-reset calls > - * do not underrun counters and quotas. The commit_mutex is used for > - * the lack a better lock, this is not transaction path. > + /* Mutex is held to prevent that two concurrent dump-and-reset calls > + * do not underrun counters and quotas. > */ > - mutex_lock(&nft_net->commit_mutex); > + mutex_lock(&nft_net->reset_mutex); > ret = nf_tables_dump_rules(skb, cb); > - mutex_unlock(&nft_net->commit_mutex); > + mutex_unlock(&nft_net->reset_mutex); > > return ret; > } > @@ -4057,9 +4056,9 @@ static int nf_tables_getrule_reset(struct sk_buff *skb, > if (!try_module_get(THIS_MODULE)) > return -EINVAL; > rcu_read_unlock(); > - mutex_lock(&nft_net->commit_mutex); > + mutex_lock(&nft_net->reset_mutex); > skb2 = nf_tables_getrule_single(portid, info, nla, true); > - mutex_unlock(&nft_net->commit_mutex); > + mutex_unlock(&nft_net->reset_mutex); > rcu_read_lock(); > module_put(THIS_MODULE); > > @@ -6346,7 +6345,7 @@ static int nf_tables_dumpreset_set(struct sk_buff *skb, > struct nft_set_dump_ctx *dump_ctx = cb->data; > int ret, skip = cb->args[0]; > > - mutex_lock(&nft_net->commit_mutex); > + mutex_lock(&nft_net->reset_mutex); > > ret = nf_tables_dump_set(skb, cb); > > @@ -6354,7 +6353,7 @@ static int nf_tables_dumpreset_set(struct sk_buff *skb, > audit_log_nft_set_reset(dump_ctx->ctx.table, cb->seq, > cb->args[0] - skip); > > - mutex_unlock(&nft_net->commit_mutex); > + mutex_unlock(&nft_net->reset_mutex); > > return ret; > } > @@ -6671,7 +6670,7 @@ static int nf_tables_getsetelem_reset(struct sk_buff *skb, > if (!try_module_get(THIS_MODULE)) > return -EINVAL; > rcu_read_unlock(); > - mutex_lock(&nft_net->commit_mutex); > + mutex_lock(&nft_net->reset_mutex); > rcu_read_lock(); > > err = nft_set_dump_ctx_init(&dump_ctx, skb, info, nla, true); > @@ -6690,7 +6689,7 @@ static int nf_tables_getsetelem_reset(struct sk_buff *skb, > > out_unlock: > rcu_read_unlock(); > - mutex_unlock(&nft_net->commit_mutex); > + mutex_unlock(&nft_net->reset_mutex); > rcu_read_lock(); > module_put(THIS_MODULE); > > @@ -8552,9 +8551,9 @@ static int nf_tables_dumpreset_obj(struct sk_buff *skb, > struct nftables_pernet *nft_net = nft_pernet(sock_net(skb->sk)); > int ret; > > - mutex_lock(&nft_net->commit_mutex); > + mutex_lock(&nft_net->reset_mutex); > ret = nf_tables_dump_obj(skb, cb); > - mutex_unlock(&nft_net->commit_mutex); > + mutex_unlock(&nft_net->reset_mutex); > > return ret; > } > @@ -8693,9 +8692,9 @@ static int nf_tables_getobj_reset(struct sk_buff *skb, > if (!try_module_get(THIS_MODULE)) > return -EINVAL; > rcu_read_unlock(); > - mutex_lock(&nft_net->commit_mutex); > + mutex_lock(&nft_net->reset_mutex); > skb2 = nf_tables_getobj_single(portid, info, nla, true); > - mutex_unlock(&nft_net->commit_mutex); > + mutex_unlock(&nft_net->reset_mutex); > rcu_read_lock(); > module_put(THIS_MODULE); > > @@ -12194,6 +12193,7 @@ static int __net_init nf_tables_init_net(struct net *net) > INIT_LIST_HEAD(&nft_net->module_list); > INIT_LIST_HEAD(&nft_net->notify_list); > mutex_init(&nft_net->commit_mutex); > + mutex_init(&nft_net->reset_mutex); > net->nft.base_seq = 1; > nft_net->gc_seq = 0; > nft_net->validate_state = NFT_VALIDATE_SKIP; > -- > 2.47.3