From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f173.google.com (mail-qt1-f173.google.com [209.85.160.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 24381335555 for ; Fri, 17 Jul 2026 19:45:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784317514; cv=none; b=rmAvCtbFk1lNKzTzjt1U5Y9JQFlm8VB3ReVcOpFklgtDlLpgTHKodtax6rgig72y38oCC5ByBf8/aRawOIRktiwu+EFxqep5fkBVgugbpgNY7RkkhNnoDuh4Rb5JV0HrY31FxdkzgvhfjN+6V7bXjIyGEGao8uMBg1G5VaMmv4E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784317514; c=relaxed/simple; bh=RxkvEXDx8KlyCHd2+X+HZ/CkG1k2fbI1E4IJ9wEZVew=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=uN5vWKtMvUcpest61zNhWhkYQsCTHHwrDjOqfqFi1FWueV0WYsKC6PEJ89jL/5CEKKqddEAUNvGIozKO2kbqvB4qIvQ/dlfqhrQyBT1gLZWkuigFoOfjzqCJ1MGvv95E278ZXb4NPA+Ch0Fe+dNaguxg39edfRoml5dP78UyBNc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=AtRcqkAs; arc=none smtp.client-ip=209.85.160.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="AtRcqkAs" Received: by mail-qt1-f173.google.com with SMTP id d75a77b69052e-51bf2479349so73296591cf.2 for ; Fri, 17 Jul 2026 12:45:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784317512; x=1784922312; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=40Iwwbwi3zfzgUmW087PtCRLpD5oHv9m7czWAQxS6Q0=; b=AtRcqkAscq9IJlcXd6onOKWeR6ZsfZf02iDmtSlNGJtV1pgonpzHcTAI9JMxN+gti1 2dzLx2zksI3oaj0V/lJDY30K50FxU1TDMv4Pqwh9GHN3Nfx6B+lZN7RTCORX+YP6VjJT cAZTmTb22fDsySjJoosrG7w8rf92yrtpK03fmNgrPR591VtiMm+Q5AI93xis5H+h0hcn 6Vw9+TY8SKyQrUg0YzH4hh83lO+r2i+umE4sr2jh110cgDfF7YyaxLhiAhspkRNFRwlx Jo7NX1xS5VRuV4upfXRcGQkzKp7GUjxrWhJFxwPqaa6Q0ZxN1Sjh4nIvm6v7yBok67Yb N3iw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784317512; x=1784922312; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=40Iwwbwi3zfzgUmW087PtCRLpD5oHv9m7czWAQxS6Q0=; b=RlcwIqwda7xAw3qGbGYqGCuD1Xz8J6vypDdDVJNx7+sB/ifLi4YUWcc24hDGUzVq6g UqWeiU1rXRgs1zhoMJAyFwhaBiVnPCxIhkfvptpwh5s4enUGgtw1Evx3SSs0nrzlPeLD 6SN8GMIMwBj6sozALUJSbq4x1e19mbiEpdxnAEJKH3gl6vnSB2gRS/3OkcrdnIZIbcYB ZTycf4o5/eYLHR66+VaGp1JatTYZO2HEIk0TAZAdTl+M/hC4PEfXgMIrr6b+QXQr3AUr 8EQ6FASplty0R0+ABapS8VdoPlJtT/ZvI99DMVlQyHVD5p9kC2l6e+7ozFoXpWG3w4su c3ag== X-Forwarded-Encrypted: i=1; AHgh+RqSQZsSGei79YT3X5aZxOR1/zN5u7Vg4N00jsw9Y2gmPaaTg7wDQH9u3D/GBfwvfYuw3nJfrqg=@vger.kernel.org X-Gm-Message-State: AOJu0YyCGgVWpjBlh1Pz1wzD0dWHRYTiBntZ7B7XtPKOAFeM1aup9ij3 pKxoDOqxiTDXlGEOSUyhanIbDgeSG/qRanK8FkvaHhBx0TauzzYxGdUtxdqdKHBN X-Gm-Gg: AfdE7cmHrUxxGSkBJs03vb7zoVrhUXGTEuVX0CuDbWFmE09k7tHEIoZkQ52nPkF3QtW x9xmBoFHBEtFu9vnn/9eFtoxS4Psz8elBRpM5Gg392Kf3SlBv1oZ/xjLsixFJw4VWbj8RAOxpDr 4Y2MORW3GyH+02mAeKuqBqGuRDLhPfQa1EdZ2S85h+MnMkNj0GzrMAxUAG6hEyC4Mt2M3xdh9pI A3ZuBoiTsI229QN2zqKoEQC6RjrQhoKtwtZgNc/Y3rAaFcLsc6KHVnkEMhL3qdUh1b863+s0z5a Bg/iWsPixMsQv9rKSfZKj63AvuEy8/0bBWRKdj5268kzXrB/nc232vpdjHSCloJ8DJBsNjq6gqZ DN17O77B299YUrE6sSTcZm50n+9KA3NZinMNcYcHu33GqbnXkg/O1PTtM72oOIo7tVR8Uhb+/NJ tIWVbPYJKpf5efkxa4XVMftiS6NktaJEo= X-Received: by 2002:a05:622a:1:b0:517:6b9c:58e4 with SMTP id d75a77b69052e-5213e28ff1fmr41926781cf.51.1784317511770; Fri, 17 Jul 2026 12:45:11 -0700 (PDT) Received: from i4-l-hqh5357-03.ad.psu.edu ([130.203.139.71]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-5214f5fb88esm19766811cf.21.2026.07.17.12.45.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jul 2026 12:45:11 -0700 (PDT) From: Shuangpeng Bai To: davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: horms@kernel.org, elic@nvidia.com, jiri@resnulli.us, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Shuangpeng Bai , stable@vger.kernel.org Subject: [PATCH] net: flow_offload: clean up indirect flow block on bind failure Date: Fri, 17 Jul 2026 15:44:55 -0400 Message-ID: <20260717194455.1734974-1-shuangpeng.kernel@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit flow_indr_dev_setup_offload() records FLOW_BLOCK_BIND requests in flow_indir_dev_list before it calls registered indirect providers. When no registered provider binds the block, it returns -EOPNOTSUPP. The replay entry is left behind. One affected path is nftables netdev offload. A netdev base chain on a device without ndo_setup_tc can take the indirect path if an indirect provider is registered. If none of the registered providers binds the block, the operation fails with -EOPNOTSUPP. The failed NEWCHAIN transaction can then abort and free the nft_base_chain, while the replay entry still points at that basechain and its flow_block cb_list. If another provider is registered later, the stale entry is replayed, potentially passing freed data to the provider callback or splicing callback entries into freed memory. Use the return value of indir_dev_add() only to track ownership of the replay entry. Preserve the existing behavior of not propagating -EEXIST or -ENOMEM. If this invocation inserted an entry, remove it again when the bind fails. Fixes: 74fc4f828769 ("net: Fix offloading indirect devices dependency on qdisc order creation") Cc: stable@vger.kernel.org Signed-off-by: Shuangpeng Bai --- net/core/flow_offload.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/net/core/flow_offload.c b/net/core/flow_offload.c index 5071d7fe6ce2..5fbb1ae4679d 100644 --- a/net/core/flow_offload.c +++ b/net/core/flow_offload.c @@ -606,15 +606,20 @@ int flow_indr_dev_setup_offload(struct net_device *dev, struct Qdisc *sch, void (*cleanup)(struct flow_block_cb *block_cb)) { struct flow_indr_dev *this; + bool replay_added = false; u32 count = 0; int err; mutex_lock(&flow_indr_block_lock); if (bo) { - if (bo->command == FLOW_BLOCK_BIND) - indir_dev_add(data, dev, sch, type, cleanup, bo); - else if (bo->command == FLOW_BLOCK_UNBIND) + if (bo->command == FLOW_BLOCK_BIND) { + int add_err; + + add_err = indir_dev_add(data, dev, sch, type, cleanup, bo); + replay_added = add_err == 0; + } else if (bo->command == FLOW_BLOCK_UNBIND) { indir_dev_remove(data); + } } list_for_each_entry(this, &flow_block_indr_dev_list, list) { @@ -623,9 +628,17 @@ int flow_indr_dev_setup_offload(struct net_device *dev, struct Qdisc *sch, count++; } + if (bo && list_empty(&bo->cb_list)) { + if (replay_added) + indir_dev_remove(data); + err = -EOPNOTSUPP; + } else { + err = count; + } + mutex_unlock(&flow_indr_block_lock); - return (bo && list_empty(&bo->cb_list)) ? -EOPNOTSUPP : count; + return err; } EXPORT_SYMBOL(flow_indr_dev_setup_offload); -- 2.43.0