From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy2-f42.google.com (mail-dy2-f42.google.com [74.125.229.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 875C3547059 for ; Sun, 27 Sep 2026 07:15:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.229.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790493339; cv=none; b=KAGP+zl6Gp8GiCIxawTREIWk86viWLmbV+HBkzezpqxEVI93of1l7G3KF9dy0OClzSNOdzSRtcV6Djjp3QZe2TZWpc7iAUqvOdXXhOUEHAX8ySCwhN0pCvMDYeM/6AvM4E90KdEvcbF1M5VWLF+XkbZK3HrciUzoHvLHFkVSUn0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790493339; c=relaxed/simple; bh=rnRLEgdA/1s1yycmRgso3T2+f+ZYJNQr7hOt/feO4pc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Y7Jtjgkhp7nkxxYITYkBQE1W0GMTJ0pEpW0zpBBW5IDbZw0XEzmvnJ5WOfuH9VJpTP9pZX46v65OUQwnqg5HU4UP6nInyjgYz3p2OcueT7unT6HVDdn6Zqc74vj2xIo8g50OLBD9UJGu0Y87yvIXfYprqkWHxtiL6nQbdFb7K4U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=MArZXFSd; arc=none smtp.client-ip=74.125.229.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="MArZXFSd" Received: by mail-dy2-f42.google.com with SMTP id 5a478bee46e88-3427977d677so145482eec.0 for ; Sun, 27 Sep 2026 00:15:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790493337; x=1791098137; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=QYM2plEZ7R9S62P1nYdznZP0BSc2LbAGxEIGE61a82Q=; b=MArZXFSdcLpj258o7hIWFACjqoPgIPWicBhrkHUfGJX7NqavbOWPxhWoCEd7dUWRsb NUR/fturKbAkT8IAH0nilHxuchUdBsDbpVFuLapj/w6VMdUrAT+WB0EfI65cxLot7OnD i1WMC1iOjczOfhazwflPGZkJ/XAMSYooAgRNOEPrFXrZZgYO9C+8iLtgb4+SZ6VGxPo7 1N2gJpmXWim2H3EeUFtC3CMNkd2JktQJhrs5KudM7geZAQg220dWSdXGDuSxt1y2GoBt rk8MukUqqHUEewXuAUPAW4Ja5mbOUvaPs35/2Nca0LyGPJEKn1fd26YrjF4egc8duet5 h0sw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790493337; x=1791098137; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=QYM2plEZ7R9S62P1nYdznZP0BSc2LbAGxEIGE61a82Q=; b=TyM5v/xnsdoz1KvUXyH9aw7NdhD+iWTS+aG4ewP5Am4hzpoHRezWo1MoEYhp23h7lN DGdBbGdCUq65Warx6+GchX1MFswMcHeXBmNQkNaj1gmPiEUEMP4cybuxN54pQF7PDTnj dyv7DipCzHb/Mx8k0/iwHhJ9uPWW1kEFA5qno4WNN7HZ0zqNXdk71lQf6K44zCtKe6cF NlbejDN5u70Zw5O9DyksuZO/sLbW0WwDnGPOWWXKl8ThumJTTB/TJj4nINU09/hv5ykj uIvOOYuGMMd2BhD1FTb4XVHUKA8ydA9vfJWEszFIClCfCztg6WQs0IkAB/Dr9PEE0PG7 x+xw== X-Forwarded-Encrypted: i=1; AKwUvBxAgsCTBr9/ZK2Vsc5T9s5iU/rUDHbIWf3mWhKxCjRFL6K20MxJmeGQIzKOUfr6j4E3wka7O64=@vger.kernel.org X-Gm-Message-State: AFq9FYKe4Bw0q85sg27Kgxys+NEgYFSRgl9s33iqsHT0j2rpuCAThdLs bf0gz7YBokHDUmxTWvCOeHo3A9Ewapnk93UoX2vSRkH/+ICHK30MeKuO X-Gm-Gg: AYBFou1YOuhG+cTAnxFeXGGhceypN9mAcWD4INEy0x6e5v9QmQvoY9AUgQ4nYkRKjOi +6IS06ZlzZVp2HQxpfH33Y1nqe4tU/9OBzMM8hL4+QolU+lteDoRMscjaWLE+B6PbHV0IVUO4Z4 hDbxpKd2M/sAPqRV21fuqKxktENO7CPTiTzb7msMgbB4PFB5fDO/ME1o8J/hURWZ12SCtHJFKIp M8+AMGjW5rqJVcusHJjN7LqqDw2SZ+snucz3GqmvK0ftpw7Txv7udHKqJFTvIyIRxbg9OnGwbie BnKdDmA/3TE7gTTevJp4D2iYCUFv7GoKgXYbQ3t8ldn+CBFz0bpv8S7mHrYsT4mT8/JQCwqxRzd FiRa/P6s5t6gPxAOE01bBAQ9cvtDQZ1ZPFrM7bNUCdOa/FUL0EcPPY05hYMLx4XRLuURPi6Mn2y 9tdn+bYNertsfH/Z6uRwQDy24fwQFb/WFPzX9DRZcnwST0UGsy015dXBV0O1tzBRIF958NCjTfn QKFkOScFeFMsDuPlQSf3hNuqyRWDin7TsITtomxuk8cRkPoB2CqVFhrlGKZyhEzBiK8YA== X-Received: by 2002:a05:7301:dd97:b0:33e:6a79:5a81 with SMTP id 5a478bee46e88-3427179721dmr7795597eec.1.1790493336434; Sun, 27 Sep 2026 00:15:36 -0700 (PDT) Received: from localhost.localdomain (95.169.12.199.16clouds.com. [95.169.12.199]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-34144b4ae50sm19610096eec.17.2026.09.27.00.15.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 27 Sep 2026 00:15:35 -0700 (PDT) From: Chengfeng Ye To: Pablo Neira Ayuso , Florian Westphal , Phil Sutter , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Chengfeng Ye , stable@vger.kernel.org Subject: [PATCH net] netfilter: nf_tables: serialize offload stats with callback unbind Date: Sun, 27 Sep 2026 15:15:20 +0800 Message-ID: <20260927071520.3693598-1-nicoyip.dev@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Rule GET and dump requests collect hardware statistics under RCU without holding commit_mutex. Callback unbind removes entries from the base chain's flow_block.cb_list and frees them immediately while holding commit_mutex, so RCU does not protect the statistics iterator. For example, a rule dump can load a block_cb in nft_setup_cb_call(), then a concurrent transaction can unbind the chain and free that callback in nft_flow_offload_unbind(). When the dump resumes, it dereferences the freed block_cb to invoke its callback. KASAN reported: BUG: KASAN: slab-use-after-free in nft_setup_cb_call.constprop.0+0x19d/0x200 Read of size 8 at addr ffff88810a64d420 by task poc/87 Call Trace: nft_setup_cb_call.constprop.0+0x19d/0x200 nft_flow_offload_cmd+0x23b/0x480 nft_flow_rule_stats+0x89/0x1d0 nf_tables_fill_rule_info+0x689/0x8e0 __nf_tables_dump_rules+0x256/0x940 nf_tables_dump_rules+0x762/0x9f0 netlink_dump+0x489/0x1140 Allocated by task 86: flow_block_cb_setup_simple+0x443/0x820 nft_block_offload_cmd+0x154/0x1e0 nft_flow_block_chain+0xf9/0x420 nft_flow_rule_offload_commit+0x448/0x5b0 Freed by task 88: kfree+0x131/0x3c0 nft_flow_offload_unbind+0x29c/0x400 nft_block_offload_cmd+0x166/0x1e0 nft_flow_block_chain+0xf9/0x420 nft_flow_rule_offload_commit+0x18d/0x5b0 Use mutex_trylock() to serialize read-side hardware statistics refresh with callback unbind. A blocking acquisition would sleep under RCU and reintroduce the commit_mutex -> nfnl_subsys_ipset -> nlk_cb_mutex -> commit_mutex lock dependency previously removed from reset dumps. On contention, skip the hardware refresh and retain the cached counters, as when the existing best-effort statistics request fails. Pass the caller's lock state so transaction notifications continue to refresh statistics under the mutex they already hold. Release an acquired mutex before dumping expressions, leaving rule lookup and callback order intact. Fixes: b72920f6e4a9 ("netfilter: nftables: counter hardware offload support") Cc: stable@vger.kernel.org Signed-off-by: Chengfeng Ye --- net/netfilter/nf_tables_api.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index b59628e6240c..f234dc3f8d1e 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3780,7 +3780,7 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, const struct nft_table *table, const struct nft_chain *chain, const struct nft_rule *rule, u64 handle, - bool reset) + bool reset, bool commit_locked) { struct nlmsghdr *nlh; const struct nft_expr *expr, *next; @@ -3806,8 +3806,15 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, goto nla_put_failure; } - if (chain->flags & NFT_CHAIN_HW_OFFLOAD) - nft_flow_rule_stats(chain, rule); + if (chain->flags & NFT_CHAIN_HW_OFFLOAD) { + struct nftables_pernet *nft_net = nft_pernet(net); + + if (commit_locked || mutex_trylock(&nft_net->commit_mutex)) { + nft_flow_rule_stats(chain, rule); + if (!commit_locked) + mutex_unlock(&nft_net->commit_mutex); + } + } list = nla_nest_start_noflag(skb, NFTA_RULE_EXPRESSIONS); if (list == NULL) @@ -3864,7 +3871,7 @@ static void nf_tables_rule_notify(const struct nft_ctx *ctx, err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq, event, flags, ctx->family, ctx->table, - ctx->chain, rule, handle, false); + ctx->chain, rule, handle, false, true); if (err < 0) { kfree_skb(skb); goto err; @@ -3924,7 +3931,8 @@ static int __nf_tables_dump_rules(struct sk_buff *skb, NFT_MSG_NEWRULE, NLM_F_MULTI | NLM_F_APPEND, table->family, - table, chain, rule, handle, ctx->reset) < 0) { + table, chain, rule, handle, + ctx->reset, false) < 0) { ret = 1; break; } @@ -4072,7 +4080,7 @@ nf_tables_getrule_single(u32 portid, const struct nfnl_info *info, err = nf_tables_fill_rule_info(skb2, net, portid, info->nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0, - family, table, chain, rule, 0, reset); + family, table, chain, rule, 0, reset, false); if (err < 0) { kfree_skb(skb2); return ERR_PTR(err); -- 2.43.0