* [PATCH nf-next] netfilter: nf_tables: check the bind callback failed and unbind callback if hook register failed
@ 2019-11-15 11:21 wenxu
2019-11-15 11:25 ` Pablo Neira Ayuso
0 siblings, 1 reply; 6+ messages in thread
From: wenxu @ 2019-11-15 11:21 UTC (permalink / raw)
To: pablo; +Cc: netfilter-devel
From: wenxu <wenxu@ucloud.cn>
Undo the callback binding before unregistering the existing hooks. It also
should check err of the bind setup call
Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
Signed-off-by: wenxu <wenxu@ucloud.cn>
---
This patch is based on:
http://patchwork.ozlabs.org/patch/1195539/
net/netfilter/nf_tables_api.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 0f8080e..149de13 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6001,12 +6001,20 @@ static int nft_register_flowtable_net_hooks(struct net *net,
}
}
- flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
- FLOW_BLOCK_BIND);
- err = nf_register_net_hook(net, &hook->ops);
+ err = flowtable->data.type->setup(&flowtable->data,
+ hook->ops.dev,
+ FLOW_BLOCK_BIND);
if (err < 0)
goto err_unregister_net_hooks;
+ err = nf_register_net_hook(net, &hook->ops);
+ if (err < 0) {
+ flowtable->data.type->setup(&flowtable->data,
+ hook->ops.dev,
+ FLOW_BLOCK_UNBIND);
+ goto err_unregister_net_hooks;
+ }
+
i++;
}
--
1.8.3.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH nf-next] netfilter: nf_tables: check the bind callback failed and unbind callback if hook register failed
2019-11-15 11:21 [PATCH nf-next] netfilter: nf_tables: check the bind callback failed and unbind callback if hook register failed wenxu
@ 2019-11-15 11:25 ` Pablo Neira Ayuso
2019-11-15 11:27 ` Pablo Neira Ayuso
2019-11-15 11:37 ` wenxu
0 siblings, 2 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2019-11-15 11:25 UTC (permalink / raw)
To: wenxu; +Cc: netfilter-devel
On Fri, Nov 15, 2019 at 07:21:26PM +0800, wenxu@ucloud.cn wrote:
> From: wenxu <wenxu@ucloud.cn>
>
> Undo the callback binding before unregistering the existing hooks. It also
> should check err of the bind setup call
>
> Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
> Signed-off-by: wenxu <wenxu@ucloud.cn>
> ---
> This patch is based on:
> http://patchwork.ozlabs.org/patch/1195539/
This is actually like this one:
https://patchwork.ozlabs.org/patch/1194046/
right?
> net/netfilter/nf_tables_api.c | 14 +++++++++++---
> 1 file changed, 11 insertions(+), 3 deletions(-)
>
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index 0f8080e..149de13 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -6001,12 +6001,20 @@ static int nft_register_flowtable_net_hooks(struct net *net,
> }
> }
>
> - flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
> - FLOW_BLOCK_BIND);
> - err = nf_register_net_hook(net, &hook->ops);
> + err = flowtable->data.type->setup(&flowtable->data,
> + hook->ops.dev,
> + FLOW_BLOCK_BIND);
I'd rather not check for the return value. ->setup returns 0 unless
you use anything else than FLOW_BLOCK_BIND or _UNBIND. Probably better
turn nf_flow_table_block_setup void and add WARN_ON_ONCE() there.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH nf-next] netfilter: nf_tables: check the bind callback failed and unbind callback if hook register failed
2019-11-15 11:25 ` Pablo Neira Ayuso
@ 2019-11-15 11:27 ` Pablo Neira Ayuso
2019-11-15 11:39 ` wenxu
2019-11-15 11:37 ` wenxu
1 sibling, 1 reply; 6+ messages in thread
From: Pablo Neira Ayuso @ 2019-11-15 11:27 UTC (permalink / raw)
To: wenxu; +Cc: netfilter-devel
[-- Attachment #1: Type: text/plain, Size: 674 bytes --]
On Fri, Nov 15, 2019 at 12:25:01PM +0100, Pablo Neira Ayuso wrote:
> On Fri, Nov 15, 2019 at 07:21:26PM +0800, wenxu@ucloud.cn wrote:
> > From: wenxu <wenxu@ucloud.cn>
> >
> > Undo the callback binding before unregistering the existing hooks. It also
> > should check err of the bind setup call
> >
> > Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
> > Signed-off-by: wenxu <wenxu@ucloud.cn>
> > ---
> > This patch is based on:
> > http://patchwork.ozlabs.org/patch/1195539/
>
> This is actually like this one:
>
> https://patchwork.ozlabs.org/patch/1194046/
>
> right?
I'm attaching the one I made based on yours that I posted yesterday.
[-- Attachment #2: 0001-netfilter-nf_tables-unbind-callbacks-if-flowtable-ho.patch --]
[-- Type: text/x-diff, Size: 1198 bytes --]
From f070db9a7fb9ecb6d2fdbd4702eb5e29b2bd5f64 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 15 Nov 2019 00:22:55 +0100
Subject: [PATCH] netfilter: nf_tables: unbind callbacks if flowtable hook
registration fails
Undo the callback binding before unregistering the existing hooks.
Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
Reported-by: wenxu <wenxu@ucloud.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
net/netfilter/nf_tables_api.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 4f0d880a8496..bd453c28a5d1 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6009,8 +6009,12 @@ static int nft_register_flowtable_net_hooks(struct net *net,
flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
FLOW_BLOCK_BIND);
err = nf_register_net_hook(net, &hook->ops);
- if (err < 0)
+ if (err < 0) {
+ flowtable->data.type->setup(&flowtable->data,
+ hook->ops.dev,
+ FLOW_BLOCK_UNBIND);
goto err_unregister_net_hooks;
+ }
i++;
}
--
2.11.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH nf-next] netfilter: nf_tables: check the bind callback failed and unbind callback if hook register failed
2019-11-15 11:25 ` Pablo Neira Ayuso
2019-11-15 11:27 ` Pablo Neira Ayuso
@ 2019-11-15 11:37 ` wenxu
2019-11-15 11:50 ` Pablo Neira Ayuso
1 sibling, 1 reply; 6+ messages in thread
From: wenxu @ 2019-11-15 11:37 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
在 2019/11/15 19:25, Pablo Neira Ayuso 写道:
>
>> net/netfilter/nf_tables_api.c | 14 +++++++++++---
>> 1 file changed, 11 insertions(+), 3 deletions(-)
>>
>> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
>> index 0f8080e..149de13 100644
>> --- a/net/netfilter/nf_tables_api.c
>> +++ b/net/netfilter/nf_tables_api.c
>> @@ -6001,12 +6001,20 @@ static int nft_register_flowtable_net_hooks(struct net *net,
>> }
>> }
>>
>> - flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
>> - FLOW_BLOCK_BIND);
>> - err = nf_register_net_hook(net, &hook->ops);
>> + err = flowtable->data.type->setup(&flowtable->data,
>> + hook->ops.dev,
>> + FLOW_BLOCK_BIND);
> I'd rather not check for the return value. ->setup returns 0 unless
> you use anything else than FLOW_BLOCK_BIND or _UNBIND. Probably better
> turn nf_flow_table_block_setup void and add WARN_ON_ONCE() there.
If BIND failed. It means hw-offload failed. But the flowtable is set as hw-offload.
Maybe it is not too make sense?
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH nf-next] netfilter: nf_tables: check the bind callback failed and unbind callback if hook register failed
2019-11-15 11:27 ` Pablo Neira Ayuso
@ 2019-11-15 11:39 ` wenxu
0 siblings, 0 replies; 6+ messages in thread
From: wenxu @ 2019-11-15 11:39 UTC (permalink / raw)
To: Pablo Neira Ayuso; +Cc: netfilter-devel
在 2019/11/15 19:27, Pablo Neira Ayuso 写道:
> On Fri, Nov 15, 2019 at 12:25:01PM +0100, Pablo Neira Ayuso wrote:
>> On Fri, Nov 15, 2019 at 07:21:26PM +0800, wenxu@ucloud.cn wrote:
>>> From: wenxu <wenxu@ucloud.cn>
>>>
>>> Undo the callback binding before unregistering the existing hooks. It also
>>> should check err of the bind setup call
>>>
>>> Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support")
>>> Signed-off-by: wenxu <wenxu@ucloud.cn>
>>> ---
>>> This patch is based on:
>>> http://patchwork.ozlabs.org/patch/1195539/
>> This is actually like this one:
>>
>> https://patchwork.ozlabs.org/patch/1194046/
>>
>> right?
> I'm attaching the one I made based on yours that I posted yesterday.
yes it is include this one.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH nf-next] netfilter: nf_tables: check the bind callback failed and unbind callback if hook register failed
2019-11-15 11:37 ` wenxu
@ 2019-11-15 11:50 ` Pablo Neira Ayuso
0 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2019-11-15 11:50 UTC (permalink / raw)
To: wenxu; +Cc: netfilter-devel
On Fri, Nov 15, 2019 at 07:37:53PM +0800, wenxu wrote:
>
> 在 2019/11/15 19:25, Pablo Neira Ayuso 写道:
> >
> >> net/netfilter/nf_tables_api.c | 14 +++++++++++---
> >> 1 file changed, 11 insertions(+), 3 deletions(-)
> >>
> >> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> >> index 0f8080e..149de13 100644
> >> --- a/net/netfilter/nf_tables_api.c
> >> +++ b/net/netfilter/nf_tables_api.c
> >> @@ -6001,12 +6001,20 @@ static int nft_register_flowtable_net_hooks(struct net *net,
> >> }
> >> }
> >>
> >> - flowtable->data.type->setup(&flowtable->data, hook->ops.dev,
> >> - FLOW_BLOCK_BIND);
> >> - err = nf_register_net_hook(net, &hook->ops);
> >> + err = flowtable->data.type->setup(&flowtable->data,
> >> + hook->ops.dev,
> >> + FLOW_BLOCK_BIND);
> > I'd rather not check for the return value. ->setup returns 0 unless
> > you use anything else than FLOW_BLOCK_BIND or _UNBIND. Probably better
> > turn nf_flow_table_block_setup void and add WARN_ON_ONCE() there.
>
> If BIND failed. It means hw-offload failed. But the flowtable is set as hw-offload.
>
> Maybe it is not too make sense?
Oh right. Your patch:
https://patchwork.ozlabs.org/patch/1195554/
is actually better. I'll take this and I'll drop mine.
Thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-11-15 11:50 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-11-15 11:21 [PATCH nf-next] netfilter: nf_tables: check the bind callback failed and unbind callback if hook register failed wenxu
2019-11-15 11:25 ` Pablo Neira Ayuso
2019-11-15 11:27 ` Pablo Neira Ayuso
2019-11-15 11:39 ` wenxu
2019-11-15 11:37 ` wenxu
2019-11-15 11:50 ` Pablo Neira Ayuso
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).