[PATCH net 0/1] Netfilter fixes for net

[PATCH net 0/1] Netfilter fixes for net

[Pablo Neira Ayuso]

Hi,

The following patchset contains a Netfilter fix for net:

Patch #1 if FPU is busy, then pipapo set backend falls back to standard
         set element lookup. Moreover, disable bh while at this.
	 From Florian Westphal.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-24-07-24

Thanks.

----------------------------------------------------------------

The following changes since commit 3ba359c0cd6eb5ea772125a7aededb4a2d516684:

  net: bonding: correctly annotate RCU in bond_should_notify_peers() (2024-07-23 15:13:12 +0200)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-24-07-24

for you to fetch changes up to a16909ae9982e931841c456061cb57fbaec9c59e:

  netfilter: nft_set_pipapo_avx2: disable softinterrupts (2024-07-24 10:01:59 +0200)

----------------------------------------------------------------
netfilter pull request 24-07-24

----------------------------------------------------------------
Florian Westphal (1):
      netfilter: nft_set_pipapo_avx2: disable softinterrupts

 net/netfilter/nft_set_pipapo_avx2.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

[PATCH net 1/1] netfilter: nft_set_pipapo_avx2: disable softinterrupts

[Pablo Neira Ayuso]

From: Florian Westphal <fw@strlen.de>

We need to disable softinterrupts, else we get following problem:

1. pipapo_avx2 called from process context; fpu usable
2. preempt_disable() called, pcpu scratchmap in use
3. softirq handles rx or tx, we re-enter pipapo_avx2
4. fpu busy, fallback to generic non-avx version
5. fallback reuses scratch map and index, which are in use
   by the preempted process

Handle this same way as generic version by first disabling
softinterrupts while the scratchmap is in use.

Fixes: f0b3d338064e ("netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 version")
Cc: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/nft_set_pipapo_avx2.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nft_set_pipapo_avx2.c b/net/netfilter/nft_set_pipapo_avx2.c
index 8910a5ac7ed1..b8d3c3213efe 100644
--- a/net/netfilter/nft_set_pipapo_avx2.c
+++ b/net/netfilter/nft_set_pipapo_avx2.c
@@ -1139,8 +1139,14 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set,
 	bool map_index;
 	int i, ret = 0;
 
-	if (unlikely(!irq_fpu_usable()))
-		return nft_pipapo_lookup(net, set, key, ext);
+	local_bh_disable();
+
+	if (unlikely(!irq_fpu_usable())) {
+		bool fallback_res = nft_pipapo_lookup(net, set, key, ext);
+
+		local_bh_enable();
+		return fallback_res;
+	}
 
 	m = rcu_dereference(priv->match);
 
@@ -1155,6 +1161,7 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set,
 	scratch = *raw_cpu_ptr(m->scratch);
 	if (unlikely(!scratch)) {
 		kernel_fpu_end();
+		local_bh_enable();
 		return false;
 	}
 
@@ -1235,6 +1242,7 @@ bool nft_pipapo_avx2_lookup(const struct net *net, const struct nft_set *set,
 	if (i % 2)
 		scratch->map_index = !map_index;
 	kernel_fpu_end();
+	local_bh_enable();
 
 	return ret >= 0;
 }
-- 
2.30.2

Re: [PATCH net 1/1] netfilter: nft_set_pipapo_avx2: disable softinterrupts

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Pablo Neira Ayuso <pablo@netfilter.org>:

On Wed, 24 Jul 2024 10:13:05 +0200 you wrote:
> From: Florian Westphal <fw@strlen.de>
> 
> We need to disable softinterrupts, else we get following problem:
> 
> 1. pipapo_avx2 called from process context; fpu usable
> 2. preempt_disable() called, pcpu scratchmap in use
> 3. softirq handles rx or tx, we re-enter pipapo_avx2
> 4. fpu busy, fallback to generic non-avx version
> 5. fallback reuses scratch map and index, which are in use
>    by the preempted process
> 
> [...]

Here is the summary with links:
  - [net,1/1] netfilter: nft_set_pipapo_avx2: disable softinterrupts
    https://git.kernel.org/netdev/net/c/a16909ae9982

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html