[PATCH nf-next,v3 3/6] netfilter: nf_tables: pass ctx to nf_tables_expr_destroy()

[Pablo Neira Ayuso]

nft_set_elem_destroy() can be called from call_rcu context. Annotate
netns and table in set object so we can populate the context object.
Moreover, pass context object to nf_tables_set_elem_destroy() from the
commit phase, since it is already available from there.

Signed-off-by: Pablo Neira Ayuso <pa...@netfilter.org>
---
 include/net/netfilter/nf_tables.h |  4 ++++
 net/netfilter/nf_tables_api.c     | 16 ++++++++++++----
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/include/net/netfilter/nf_tables.h 
b/include/net/netfilter/nf_tables.h
index debe4c0be032..be3665547839 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -374,6 +374,8 @@ void nft_unregister_set(struct nft_set_type *type);
  *
  *     @list: table set list node
  *     @bindings: list of set bindings
+ *     @table: table this set belongs to
+ *     @net: netnamespace this set belongs to
  *     @name: name of the set
  *     @handle: unique handle of the set
  *     @ktype: key type (numeric type defined by userspace, not used in the 
kernel)
@@ -397,6 +399,8 @@ void nft_unregister_set(struct nft_set_type *type);
 struct nft_set {
        struct list_head                list;
        struct list_head                bindings;
+       struct nft_table                *table;
+       possible_net_t                  net;
        char                            *name;
        u64                             handle;
        u32                             ktype;
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 08c49a372beb..3adb00eae039 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3233,6 +3233,8 @@ static int nf_tables_newset(struct net *net, struct sock 
*nlsk,
        }
 
        INIT_LIST_HEAD(&set->bindings);
+       set->table = table;
+       write_pnet(&set->net, net);
        set->ops   = ops;
        set->ktype = ktype;
        set->klen  = desc.klen;
@@ -3897,12 +3899,16 @@ void nft_set_elem_destroy(const struct nft_set *set, 
void *elem,
                          bool destroy_expr)
 {
        struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
+       struct nft_ctx ctx = {
+               .net    = read_pnet(&set->net),
+               .family = set->table->family,
+       };
 
        nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
        if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
                nft_data_release(nft_set_ext_data(ext), set->dtype);
        if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
-               nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
+               nf_tables_expr_destroy(&ctx, nft_set_ext_expr(ext));
        if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
                (*nft_set_ext_obj(ext))->use--;
        kfree(elem);
@@ -3912,12 +3918,13 @@ EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
 /* Only called from commit path, nft_set_elem_deactivate() already deals with
  * the refcounting from the preparation phase.
  */
-static void nf_tables_set_elem_destroy(const struct nft_set *set, void *elem)
+static void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
+                                      const struct nft_set *set, void *elem)
 {
        struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
 
        if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
-               nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
+               nf_tables_expr_destroy(ctx, nft_set_ext_expr(ext));
        kfree(elem);
 }
 
@@ -5817,7 +5824,8 @@ static void nft_commit_release(struct nft_trans *trans)
                nft_set_destroy(nft_trans_set(trans));
                break;
        case NFT_MSG_DELSETELEM:
-               nf_tables_set_elem_destroy(nft_trans_elem_set(trans),
+               nf_tables_set_elem_destroy(&trans->ctx,
+                                          nft_trans_elem_set(trans),
                                           nft_trans_elem(trans).priv);
                break;
        case NFT_MSG_DELOBJ:
-- 
2.11.0

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html