| From e85fa574e66459a838126f67206ac459bc0e1ab5 Mon Sep 17 00:00:00 2001 |
| From: Pablo Neira Ayuso <pablo@netfilter.org> |
| Date: Mon, 14 Oct 2019 11:03:15 +0200 |
| Subject: [PATCH] netfilter: nf_flow_table: set timeout before insertion into |
| hashes |
| |
| commit daf61b026f4686250e6afa619e6d7b49edc61df7 upstream. |
| |
| Other garbage collector might remove an entry not fully set up yet. |
| |
| [570953.958293] RIP: 0010:memcmp+0x9/0x50 |
| [...] |
| [570953.958567] flow_offload_hash_cmp+0x1e/0x30 [nf_flow_table] |
| [570953.958585] flow_offload_lookup+0x8c/0x110 [nf_flow_table] |
| [570953.958606] nf_flow_offload_ip_hook+0x135/0xb30 [nf_flow_table] |
| [570953.958624] nf_flow_offload_inet_hook+0x35/0x37 [nf_flow_table_inet] |
| [570953.958646] nf_hook_slow+0x3c/0xb0 |
| [570953.958664] __netif_receive_skb_core+0x90f/0xb10 |
| [570953.958678] ? ip_rcv_finish+0x82/0xa0 |
| [570953.958692] __netif_receive_skb_one_core+0x3b/0x80 |
| [570953.958711] __netif_receive_skb+0x18/0x60 |
| [570953.958727] netif_receive_skb_internal+0x45/0xf0 |
| [570953.958741] napi_gro_receive+0xcd/0xf0 |
| [570953.958764] ixgbe_clean_rx_irq+0x432/0xe00 [ixgbe] |
| [570953.958782] ixgbe_poll+0x27b/0x700 [ixgbe] |
| [570953.958796] net_rx_action+0x284/0x3c0 |
| [570953.958817] __do_softirq+0xcc/0x27c |
| [570953.959464] irq_exit+0xe8/0x100 |
| [570953.960097] do_IRQ+0x59/0xe0 |
| [570953.960734] common_interrupt+0xf/0xf |
| |
| Fixes: 43c8f131184f ("netfilter: nf_flow_table: fix missing error check for rhashtable_insert_fast") |
| Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c |
| index 55106bebf2b5..750fd60dad6f 100644 |
| --- a/net/netfilter/nf_flow_table_core.c |
| +++ b/net/netfilter/nf_flow_table_core.c |
| @@ -202,6 +202,8 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow) |
| { |
| int err; |
| |
| + flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT; |
| + |
| err = rhashtable_insert_fast(&flow_table->rhashtable, |
| &flow->tuplehash[0].node, |
| nf_flow_offload_rhash_params); |
| @@ -218,7 +220,6 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow) |
| return err; |
| } |
| |
| - flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT; |
| return 0; |
| } |
| EXPORT_SYMBOL_GPL(flow_offload_add); |
| -- |
| 2.7.4 |
| |
