From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E665F41DDFD for ; Thu, 23 Jul 2026 16:54:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784825675; cv=none; b=qnqE3xVUEkfoZj2uT1KkjyMgkMGoCpTPbTBZ+DFMti+QiPQ+FumwO0UD0f1TkhEMHHiOJq56sYFAvmW6/wNO/bcmFdDWxorqD+zW4UoToPOCx97w8inkKPx4ZX7ugHW1cM9yVAwrH6D/GhqcjXnoxQuClDw2ChBTKaKUk6+XruE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784825675; c=relaxed/simple; bh=95itYdnfT2BaX+chD4yOkULm4CWeoPNMP1IuXA4lE2Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=e/7PMBCn5251QPcNKI1EMwMffgGcNJfEg+aKbInW22k2nib5/pRY2Nr1RyU97GHugd5V4z5R7q9uXD/0rwgglysCKSk+Y+jyLskr6yAPhA9UYDK+WUNW+F99axzAKOTHeGqDM4pJYvmzav1y+ISkxRcpAR9Jb2wnwptsRF88EKs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=mdIBV297; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="mdIBV297" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4A9B11F00A3E; Thu, 23 Jul 2026 16:54:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784825673; bh=e6T2knNuUWhbBqB5a5932HAsgXuTMfGolmFfSDrQTlE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=mdIBV297PGAW5QZMpkMoUvnmd2wthfMNVThTs2Kl/NkNWU7n57+6sukPXQxmqZZ0n OXWfE8eAphF2PzfyEj3o3Mris391As3ASMYPhFi+vejK08fvjYhkp887WMnqEM0M7U pH4YnMEKs1M71EUOOxzlR4xIt4bFfjP2/GvMeMmpQ5Pru3p3rOvJnrWUPDJwblEKb7 hvAA9zmzdXLo1L1TB0wdCGoLm/Sxv1DgPAO7BhF2bdjJASgU/BJDpkpvFHE3KWQCKq vYgVpFjWbCAGKLu08+oDIo4eKLSmeqVcQr/HIkGlUO938iz12pUgkRNbd5z4xAJIYo hNnOPRiq0tejA== From: Sasha Levin To: stable@vger.kernel.org Cc: Florian Westphal , Stefano Brivio , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 5.15.y 7/8] netfilter: nft_set_pipapo: move cloning of match info to insert/removal path Date: Thu, 23 Jul 2026 12:54:26 -0400 Message-ID: <20260723165427.3390871-7-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260723165427.3390871-1-sashal@kernel.org> References: <2026072016-hurling-turmoil-5fb2@gregkh> <20260723165427.3390871-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Florian Westphal [ Upstream commit 3f1d886cc7c3525d4dbeee24bfa9bb3fe0d48ddc ] This set type keeps two copies of the sets' content, priv->match (live version, used to match from packet path) priv->clone (work-in-progress version of the 'future' priv->match). All additions and removals are done on priv->clone. When transaction completes, priv->clone becomes priv->match and a new clone is allocated for use by next transaction. Problem is that the cloning requires GFP_KERNEL allocations but we cannot fail at either commit or abort time. This patch defers the clone until we get an insertion or removal request. This allows us to handle OOM situations correctly. This also allows to remove ->dirty in a followup change: If ->clone exists, ->dirty is always true If ->clone is NULL, ->dirty is always false, no elements were added or removed (except catchall elements which are external to the specific set backend). Signed-off-by: Florian Westphal Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso Stable-dep-of: 47e65eff5069 ("netfilter: nft_set_pipapo: don't leak bad clone into future transaction") Signed-off-by: Sasha Levin --- net/netfilter/nft_set_pipapo.c | 70 ++++++++++++++++++++++++---------- 1 file changed, 49 insertions(+), 21 deletions(-) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 12bb73111159cc..beb767c2878566 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1203,6 +1203,29 @@ static bool nft_pipapo_transaction_mutex_held(const struct nft_set *set) #endif } +static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old); + +/** + * pipapo_maybe_clone() - Build clone for pending data changes, if not existing + * @set: nftables API set representation + * + * Return: newly created or existing clone, if any. NULL on allocation failure + */ +static struct nft_pipapo_match *pipapo_maybe_clone(const struct nft_set *set) +{ + struct nft_pipapo *priv = nft_set_priv(set); + struct nft_pipapo_match *m; + + if (priv->clone) + return priv->clone; + + m = rcu_dereference_protected(priv->match, + nft_pipapo_transaction_mutex_held(set)); + priv->clone = pipapo_clone(m); + + return priv->clone; +} + /** * nft_pipapo_insert() - Validate and insert ranged elements * @net: Network namespace @@ -1219,15 +1242,18 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); union nft_pipapo_map_bucket rulemap[NFT_PIPAPO_MAX_FIELDS]; const u8 *start = (const u8 *)elem->key.val.data, *end; + struct nft_pipapo_match *m = pipapo_maybe_clone(set); struct nft_pipapo_elem *e = elem->priv, *dup; struct nft_pipapo *priv = nft_set_priv(set); - struct nft_pipapo_match *m = priv->clone; u8 genmask = nft_genmask_next(net); u64 tstamp = nft_net_tstamp(net); struct nft_pipapo_field *f; const u8 *start_p, *end_p; int i, bsize_max, err = 0; + if (!m) + return -ENOMEM; + if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END)) end = (const u8 *)nft_set_ext_key_end(ext)->data; else @@ -1763,7 +1789,10 @@ static void pipapo_reclaim_match(struct rcu_head *rcu) static void nft_pipapo_commit(struct nft_set *set) { struct nft_pipapo *priv = nft_set_priv(set); - struct nft_pipapo_match *new_clone, *old; + struct nft_pipapo_match *old; + + if (!priv->clone) + return; if (time_after_eq(jiffies, priv->last_gc + nft_set_gc_interval(set))) pipapo_gc_scan(set, priv->clone); @@ -1771,40 +1800,29 @@ static void nft_pipapo_commit(struct nft_set *set) if (!priv->dirty) return; - new_clone = pipapo_clone(priv->clone); - if (!new_clone) - return; - + old = rcu_replace_pointer(priv->match, priv->clone, + nft_pipapo_transaction_mutex_held(set)); + priv->clone = NULL; priv->dirty = false; - old = rcu_access_pointer(priv->match); - rcu_assign_pointer(priv->match, priv->clone); if (old) call_rcu(&old->rcu, pipapo_reclaim_match); - priv->clone = new_clone; - pipapo_gc_queue(set); } static void nft_pipapo_abort(const struct nft_set *set) { struct nft_pipapo *priv = nft_set_priv(set); - struct nft_pipapo_match *new_clone, *m; if (!priv->dirty) return; - m = rcu_dereference_protected(priv->match, nft_pipapo_transaction_mutex_held(set)); - - new_clone = pipapo_clone(m); - if (!new_clone) + if (!priv->clone) return; - priv->dirty = false; - pipapo_free_match(priv->clone); - priv->clone = new_clone; + priv->clone = NULL; } /** @@ -1839,10 +1857,15 @@ static void *nft_pipapo_deactivate(const struct net *net, const struct nft_set *set, const struct nft_set_elem *elem) { - const struct nft_pipapo *priv = nft_set_priv(set); - struct nft_pipapo_match *m = priv->clone; + struct nft_pipapo_match *m = pipapo_maybe_clone(set); struct nft_pipapo_elem *e; + /* removal must occur on priv->clone, if we are low on memory + * we have no choice and must fail the removal request. + */ + if (!m) + return NULL; + e = pipapo_get(net, set, m, (const u8 *)elem->key.val.data, nft_genmask_next(net), nft_net_tstamp(net), GFP_KERNEL); if (IS_ERR(e)) @@ -2128,7 +2151,12 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, switch (iter->type) { case NFT_ITER_UPDATE: - m = priv->clone; + m = pipapo_maybe_clone(set); + if (!m) { + iter->err = -ENOMEM; + return; + } + nft_pipapo_do_walk(ctx, set, m, iter); break; case NFT_ITER_READ: -- 2.53.0