[PATCH net-next] netfilter: xt_owner: no longer acquire sk_callback_lock in mt_owner()

[PATCH net-next] netfilter: xt_owner: no longer acquire sk_callback_lock in mt_owner()

[Eric Dumazet]

After commit 983512f3a87f ("net: Drop the lock in skb_may_tx_timestamp()")
from Sebastian Andrzej Siewior, apply the same logic in mt_owner()
to avoid touching sk_callback_lock.

Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/netfilter/xt_owner.c | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c
index 50332888c8d233aab0915a31f2f616f3171da45e..5845eabe6161b3a90df422e6e1055165d6538791 100644
--- a/net/netfilter/xt_owner.c
+++ b/net/netfilter/xt_owner.c
@@ -63,11 +63,12 @@ static bool
 owner_mt(const struct sk_buff *skb, struct xt_action_param *par)
 {
 	const struct xt_owner_match_info *info = par->matchinfo;
-	const struct file *filp;
 	struct sock *sk = skb_to_full_sk(skb);
 	struct net *net = xt_net(par);
+	const struct socket *sock;
+	const struct file *filp;
 
-	if (!sk || !sk->sk_socket || !net_eq(net, sock_net(sk)))
+	if (!sk || !READ_ONCE(sk->sk_socket) || !net_eq(net, sock_net(sk)))
 		return (info->match ^ info->invert) == 0;
 	else if (info->match & info->invert & XT_OWNER_SOCKET)
 		/*
@@ -76,10 +77,16 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		 */
 		return false;
 
-	read_lock_bh(&sk->sk_callback_lock);
-	filp = sk->sk_socket ? sk->sk_socket->file : NULL;
+	/* The sk pointer remains valid as long as the skb is. The sk_socket and
+	 * file pointer may become NULL if the socket is closed. Both structures
+	 * (including file->cred) are RCU freed which means they can be accessed
+	 * within a RCU read section.
+	 */
+	rcu_read_lock();
+	sock = READ_ONCE(sk->sk_socket);
+	filp = sock ? READ_ONCE(sock->file) : NULL;
 	if (filp == NULL) {
-		read_unlock_bh(&sk->sk_callback_lock);
+		rcu_read_unlock();
 		return ((info->match ^ info->invert) &
 		       (XT_OWNER_UID | XT_OWNER_GID)) == 0;
 	}
@@ -90,7 +97,7 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		if ((uid_gte(filp->f_cred->fsuid, uid_min) &&
 		     uid_lte(filp->f_cred->fsuid, uid_max)) ^
 		    !(info->invert & XT_OWNER_UID)) {
-			read_unlock_bh(&sk->sk_callback_lock);
+			rcu_read_unlock();
 			return false;
 		}
 	}
@@ -118,12 +125,12 @@ owner_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		}
 
 		if (match ^ !(info->invert & XT_OWNER_GID)) {
-			read_unlock_bh(&sk->sk_callback_lock);
+			rcu_read_unlock();
 			return false;
 		}
 	}
 
-	read_unlock_bh(&sk->sk_callback_lock);
+	rcu_read_unlock();
 	return true;
 }
 
-- 
2.53.0.371.g1d285c8824-goog

Re: [PATCH net-next] netfilter: xt_owner: no longer acquire sk_callback_lock in mt_owner()

[Florian Westphal]

Eric Dumazet <edumazet@google.com> wrote:
> After commit 983512f3a87f ("net: Drop the lock in skb_may_tx_timestamp()")
> from Sebastian Andrzej Siewior, apply the same logic in mt_owner()
> to avoid touching sk_callback_lock.
> -	read_lock_bh(&sk->sk_callback_lock);
> -	filp = sk->sk_socket ? sk->sk_socket->file : NULL;
> +	/* The sk pointer remains valid as long as the skb is. The sk_socket and
> +	 * file pointer may become NULL if the socket is closed. Both structures
> +	 * (including file->cred) are RCU freed which means they can be accessed
> +	 * within a RCU read section.
> +	 */
> +	rcu_read_lock();
> +	sock = READ_ONCE(sk->sk_socket);
> +	filp = sock ? READ_ONCE(sock->file) : NULL;

Thanks for doing this Eric!

Minor nit: rcu_read_lock is already acquired from nf_hook() helper, so
we aleays have it in both iptables and nftables.

Reviewed-by: Florian Westphal <fw@strlen.de>

Re: [PATCH net-next] netfilter: xt_owner: no longer acquire sk_callback_lock in mt_owner()

[Eric Dumazet]

On Tue, Feb 24, 2026 at 1:52 PM Florian Westphal <fw@strlen.de> wrote:
>
> Eric Dumazet <edumazet@google.com> wrote:
> > After commit 983512f3a87f ("net: Drop the lock in skb_may_tx_timestamp()")
> > from Sebastian Andrzej Siewior, apply the same logic in mt_owner()
> > to avoid touching sk_callback_lock.
> > -     read_lock_bh(&sk->sk_callback_lock);
> > -     filp = sk->sk_socket ? sk->sk_socket->file : NULL;
> > +     /* The sk pointer remains valid as long as the skb is. The sk_socket and
> > +      * file pointer may become NULL if the socket is closed. Both structures
> > +      * (including file->cred) are RCU freed which means they can be accessed
> > +      * within a RCU read section.
> > +      */
> > +     rcu_read_lock();
> > +     sock = READ_ONCE(sk->sk_socket);
> > +     filp = sock ? READ_ONCE(sock->file) : NULL;
>
> Thanks for doing this Eric!
>
> Minor nit: rcu_read_lock is already acquired from nf_hook() helper, so
> we aleays have it in both iptables and nftables.
>
> Reviewed-by: Florian Westphal <fw@strlen.de>

Sure, I will remove the rcu_read_lock()/rcu_read_unlock()

Do you think adding lockdep_assert_in_rcu_read_lock() would be useful
or would it be too much, iptables/nftables willl always be run under RCU
and this is well understood ?

Thanks.

Re: [PATCH net-next] netfilter: xt_owner: no longer acquire sk_callback_lock in mt_owner()

[Florian Westphal]

Eric Dumazet <edumazet@google.com> wrote:
> Sure, I will remove the rcu_read_lock()/rcu_read_unlock()
> 
> Do you think adding lockdep_assert_in_rcu_read_lock() would be useful
> or would it be too much, iptables/nftables willl always be run under RCU
> and this is well understood ?

I don't think the lockdep assertion is needed; but I don't mind if you
add one.

All netfilter hooks run under rcu:

static inline int nf_hook(u_int8_t pf, unsigned int hook, struct net *net,
                          struct sock *sk, struct sk_buff *skb,
                          struct net_device *indev, struct net_device *outdev,
                          int (*okfn)(struct net *, struct sock *, struct sk_buff *))
{
        struct nf_hook_entries *hook_head = NULL;
        int ret = 1;

	[..]

        rcu_read_lock();
        switch (pf) {
        case NFPROTO_IPV4:
                hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);
	[..]
	if (hook_head) {

                ret = nf_hook_slow(skb, &state, hook_head, 0);
        }
        rcu_read_unlock();
	[..]

Thanks Eric!