From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3444D25FA13; Tue, 8 Apr 2025 11:39:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744112359; cv=none; b=Nck+3suThnuLpnEgtJYPaC9WFLjLidQc9HfgkaYa4rd1CiwFVwtZ+UBYP0bd9eRjyRZhzbLVWAajykGaT2tXsIITO8/7YLHvA+rfr7NlUchjohM+iQb7V/dV683LHj40D5wiThc+LATVWDhx+l0rLsqZMH0eYNtIwRipmPjYpBc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744112359; c=relaxed/simple; bh=XKAb/rXXeZuIQQmQ4/ABt8kb0orOMRIqqYqfFDvtEMw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eQ+h64jQX0pL0hbmJCjLHGahNehKwTknHoOVvYVHlBsHdVapFomT/3PfEA8+HJqX/KrOP2FQkcUKPvxQSYXDzJp0DEO4BqeJ6YGaAt3f3CXMVhdPrpcQ4KL1fYJG2cqI8mzuEE5CKqTlBOVlzBBmOt4JFtvvDV7t66GVybTTfqA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=CpvtVXz4; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="CpvtVXz4" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B820EC4CEE7; Tue, 8 Apr 2025 11:39:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1744112359; bh=XKAb/rXXeZuIQQmQ4/ABt8kb0orOMRIqqYqfFDvtEMw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CpvtVXz4/Yz81o1fS8f5W9GQEX8ZFB/1TKqKMo2aKu39oDfP8Rsd+I4SV6RRQtLNB evaIX5BqBeg0nOZUTVrtKoBtn8RRrB4dnjL/2GuWOkQIriQHQlwge7XI3JE3GodM9j 1hxv5DBf9bFc9lJEVlgwOqEpv91IPtcYwd/FOVfM= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Sebastian Andrzej Siewior , Florian Westphal , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 5.15 007/279] netfilter: nft_ct: Use __refcount_inc() for per-CPU nft_ct_pcpu_template. Date: Tue, 8 Apr 2025 12:46:30 +0200 Message-ID: <20250408104826.557387057@linuxfoundation.org> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250408104826.319283234@linuxfoundation.org> References: <20250408104826.319283234@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sebastian Andrzej Siewior [ Upstream commit 5cfe5612ca9590db69b9be29dc83041dbf001108 ] nft_ct_pcpu_template is a per-CPU variable and relies on disabled BH for its locking. The refcounter is read and if its value is set to one then the refcounter is incremented and variable is used - otherwise it is already in use and left untouched. Without per-CPU locking in local_bh_disable() on PREEMPT_RT the read-then-increment operation is not atomic and therefore racy. This can be avoided by using unconditionally __refcount_inc() which will increment counter and return the old value as an atomic operation. In case the returned counter is not one, the variable is in use and we need to decrement counter. Otherwise we can use it. Use __refcount_inc() instead of read and a conditional increment. Fixes: edee4f1e9245 ("netfilter: nft_ct: add zone id set support") Signed-off-by: Sebastian Andrzej Siewior Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/netfilter/nft_ct.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c index 69214993b5a2c..83bb3f110ea84 100644 --- a/net/netfilter/nft_ct.c +++ b/net/netfilter/nft_ct.c @@ -239,6 +239,7 @@ static void nft_ct_set_zone_eval(const struct nft_expr *expr, enum ip_conntrack_info ctinfo; u16 value = nft_reg_load16(®s->data[priv->sreg]); struct nf_conn *ct; + int oldcnt; ct = nf_ct_get(skb, &ctinfo); if (ct) /* already tracked */ @@ -259,10 +260,11 @@ static void nft_ct_set_zone_eval(const struct nft_expr *expr, ct = this_cpu_read(nft_ct_pcpu_template); - if (likely(refcount_read(&ct->ct_general.use) == 1)) { - refcount_inc(&ct->ct_general.use); + __refcount_inc(&ct->ct_general.use, &oldcnt); + if (likely(oldcnt == 1)) { nf_ct_zone_add(ct, &zone); } else { + refcount_dec(&ct->ct_general.use); /* previous skb got queued to userspace, allocate temporary * one until percpu template can be reused. */ -- 2.39.5