[PATCH 4.14 0/1] netfilter: Fix EBUSY when removing objref

[PATCH 4.14 0/1] netfilter: Fix EBUSY when removing objref

[Thadeu Lima de Souza Cascardo]

When removing a rule with an objref expression and the object it references in
the same batch, it will return EBUSY. The backported commit has a Fixes line
for one of the commits recently backported.

Pablo Neira Ayuso (1):
  netfilter: nf_tables: bogus EBUSY in helper removal from transaction

 net/netfilter/nft_objref.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

-- 
2.34.1

[PATCH 4.14 1/1] netfilter: nf_tables: bogus EBUSY in helper removal from transaction

[Thadeu Lima de Souza Cascardo]

From: Pablo Neira Ayuso <pablo@netfilter.org>

commit 8ffcd32f64633926163cdd07a7d295c500a947d1 upstream.

Proper use counter updates when activating and deactivating the object,
otherwise, this hits bogus EBUSY error.

Fixes: cd5125d8f518 ("netfilter: nf_tables: split set destruction in deactivate and destroy phase")
Reported-by: Laura Garcia <nevola@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
---
 net/netfilter/nft_objref.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/net/netfilter/nft_objref.c b/net/netfilter/nft_objref.c
index 49a067a67e72..5deb997db9bb 100644
--- a/net/netfilter/nft_objref.c
+++ b/net/netfilter/nft_objref.c
@@ -64,21 +64,34 @@ static int nft_objref_dump(struct sk_buff *skb, const struct nft_expr *expr)
 	return -1;
 }
 
-static void nft_objref_destroy(const struct nft_ctx *ctx,
-			       const struct nft_expr *expr)
+static void nft_objref_deactivate(const struct nft_ctx *ctx,
+				  const struct nft_expr *expr,
+				  enum nft_trans_phase phase)
 {
 	struct nft_object *obj = nft_objref_priv(expr);
 
+	if (phase == NFT_TRANS_COMMIT)
+		return;
+
 	obj->use--;
 }
 
+static void nft_objref_activate(const struct nft_ctx *ctx,
+				const struct nft_expr *expr)
+{
+	struct nft_object *obj = nft_objref_priv(expr);
+
+	obj->use++;
+}
+
 static struct nft_expr_type nft_objref_type;
 static const struct nft_expr_ops nft_objref_ops = {
 	.type		= &nft_objref_type,
 	.size		= NFT_EXPR_SIZE(sizeof(struct nft_object *)),
 	.eval		= nft_objref_eval,
 	.init		= nft_objref_init,
-	.destroy	= nft_objref_destroy,
+	.activate	= nft_objref_activate,
+	.deactivate	= nft_objref_deactivate,
 	.dump		= nft_objref_dump,
 };
 
-- 
2.34.1

Re: [PATCH 4.14 1/1] netfilter: nf_tables: bogus EBUSY in helper removal from transaction

[Greg KH]

On Fri, May 19, 2023 at 04:28:59PM -0300, Thadeu Lima de Souza Cascardo wrote:
> From: Pablo Neira Ayuso <pablo@netfilter.org>
> 
> commit 8ffcd32f64633926163cdd07a7d295c500a947d1 upstream.
> 
> Proper use counter updates when activating and deactivating the object,
> otherwise, this hits bogus EBUSY error.
> 
> Fixes: cd5125d8f518 ("netfilter: nf_tables: split set destruction in deactivate and destroy phase")
> Reported-by: Laura Garcia <nevola@gmail.com>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
> ---
>  net/netfilter/nft_objref.c | 19 ++++++++++++++++---
>  1 file changed, 16 insertions(+), 3 deletions(-)
> 

Now queued up, thanks.

greg k-h