From: Lorenzo Bianconi <lorenzo@kernel.org>
To: Pablo Neira Ayuso <pablo@netfilter.org>,
Jozsef Kadlecsik <kadlec@netfilter.org>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>,
Paolo Abeni <pabeni@redhat.com>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Jesper Dangaard Brouer <hawk@kernel.org>,
John Fastabend <john.fastabend@gmail.com>,
Florian Westphal <fw@strlen.de>
Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
netdev@vger.kernel.org, bpf@vger.kernel.org,
Lorenzo Bianconi <lorenzo@kernel.org>
Subject: [PATCH net] netfilter: nf_tables: Fix memory leak in nf_flow_offload_xdp_setup()
Date: Fri, 11 Oct 2024 01:31:32 +0200 [thread overview]
Message-ID: <20241011-flowtable-xdp-memleak-v1-1-b32aacb65b99@kernel.org> (raw)
nf_flow_offload_xdp_setup routine allocates/removes entries in
nf_xdp_hashtable hash running FLOW_BLOCK_BIND/FLOW_BLOCK_UNBIND
commands. In the current codebase we have an FLOW_BLOCK_BIND/
FLOW_BLOCK_UNBIND unbalance since we do not run FLOW_BLOCK_UNBIND in
__nft_unregister_flowtable_net_hooks() triggering the following error
reported by kmeamlak:
[<00000000be65a589>] __kmalloc_cache_noprof+0x280/0x310
[<00000000c6569ad4>] nf_flow_offload_xdp_setup+0x70/0x8d0 [nf_flow_table]
[<000000001efe6e35>] nf_flow_table_offload_setup+0x324/0x610 [nf_flow_table]
[<000000005d9c9ad6>] nft_register_flowtable_net_hooks+0x3f4/0x890 [nf_tables]
[<00000000de9071ee>] nf_tables_newflowtable+0xf61/0x18c0 [nf_tables]
[<00000000924f5d86>] nfnetlink_rcv_batch+0x12c1/0x1c50 [nfnetlink]
[<000000003fa07104>] nfnetlink_rcv+0x2a3/0x320 [nfnetlink]
[<000000009fd1c990>] netlink_unicast+0x588/0x7f0
[<00000000ee126795>] netlink_sendmsg+0x702/0xba0
[<000000000ddf29fb>] ____sys_sendmsg+0x7cd/0x9a0
[<0000000027b80416>] ___sys_sendmsg+0xd6/0x140
[<00000000edfe1eb5>] __sys_sendmsg+0xba/0x150
[<000000009d5eb571>] do_syscall_64+0x47/0x110
[<0000000077c3a21e>] entry_SYSCALL_64_after_hwframe+0x76/0x7e
Fix the issue running FLOW_BLOCK_UNBIND command in
__nft_unregister_flowtable_net_hooks() if the nft_hook is removed.
Fixes: 89cc8f1c5f22 ("netfilter: nf_tables: Add flowtable map for xdp offload")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
---
net/netfilter/nf_tables_api.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index a24fe62650a753be872a2051b34ff0aba27ef8c4..53357b61700b01048e840154dffd55a2c05062c1 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -8546,14 +8546,18 @@ static void nft_unregister_flowtable_hook(struct net *net,
}
static void __nft_unregister_flowtable_net_hooks(struct net *net,
- struct list_head *hook_list,
- bool release_netdev)
+ struct nft_flowtable *flowtable,
+ struct list_head *hook_list)
{
struct nft_hook *hook, *next;
list_for_each_entry_safe(hook, next, hook_list, list) {
+ if (flowtable)
+ flowtable->data.type->setup(&flowtable->data,
+ hook->ops.dev,
+ FLOW_BLOCK_UNBIND);
nf_unregister_net_hook(net, &hook->ops);
- if (release_netdev) {
+ if (flowtable) {
list_del(&hook->list);
kfree_rcu(hook, rcu);
}
@@ -8563,7 +8567,7 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net,
static void nft_unregister_flowtable_net_hooks(struct net *net,
struct list_head *hook_list)
{
- __nft_unregister_flowtable_net_hooks(net, hook_list, false);
+ __nft_unregister_flowtable_net_hooks(net, NULL, hook_list);
}
static int nft_register_flowtable_net_hooks(struct net *net,
@@ -11459,8 +11463,8 @@ static void __nft_release_hook(struct net *net, struct nft_table *table)
list_for_each_entry(chain, &table->chains, list)
__nf_tables_unregister_hook(net, table, chain, true);
list_for_each_entry(flowtable, &table->flowtables, list)
- __nft_unregister_flowtable_net_hooks(net, &flowtable->hook_list,
- true);
+ __nft_unregister_flowtable_net_hooks(net, flowtable,
+ &flowtable->hook_list);
}
static void __nft_release_hooks(struct net *net)
---
base-commit: 1d227fcc72223cbdd34d0ce13541cbaab5e0d72f
change-id: 20241011-flowtable-xdp-memleak-05cdd4c22369
Best regards,
--
Lorenzo Bianconi <lorenzo@kernel.org>
reply other threads:[~2024-10-10 23:31 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20241011-flowtable-xdp-memleak-v1-1-b32aacb65b99@kernel.org \
--to=lorenzo@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=coreteam@netfilter.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=hawk@kernel.org \
--cc=john.fastabend@gmail.com \
--cc=kadlec@netfilter.org \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).