From patchwork Thu Jul 6 23:25:50 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Xu X-Patchwork-Id: 116890 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:9f45:0:b0:3ea:f831:8777 with SMTP id v5csp2915808vqx; Thu, 6 Jul 2023 17:10:53 -0700 (PDT) X-Google-Smtp-Source: APBJJlGtKuZTMDsRlbWMY0rwqtbIjN/C3sfAA0wc8dTSJ9b1q5H5ETuCajGrZyVXbRn/8l114cJL X-Received: by 2002:a05:6a00:2d95:b0:67f:6d90:8fb with SMTP id fb21-20020a056a002d9500b0067f6d9008fbmr11072201pfb.13.1688688652555; Thu, 06 Jul 2023 17:10:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1688688652; cv=none; d=google.com; s=arc-20160816; b=V4w9NP6HcQFVh/IhGm2rTlzQMtiBIflV84vWmInb28Xrujt9UAXEkGzfTcXKsYhAgN onhZ8HHKzWqd34SxSoE929eImUvChu9nttImpFQ2vqaIYSxpETmv7L4QJzReJUAqPzYu b84w8ivPbbXVzldvH7qpPqFfO1ehiPg/aVZp3X+aP9Jy6jKZWwyUNIu7MCmnwhI3e210 NC6aDQjw3bwXU1Fk0nT/RAqePuyWopwMnMD4Qjb5LOOtRczTb/+kAedV8arX/wKVFJ07 z+KcxjtmycD/fbMHvU57g8i5sATEyvJi5R4euSHl5Hkn56ktc2GekQHMqJFYM3WOI0on vsSw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :feedback-id:dkim-signature:dkim-signature; bh=q+GZB03bv8FWk8Fi1TVDaCiqNoaHfJjJsc6EY7aLdqg=; fh=qytofXQDSSx1dX/v4sq810d9TTT0D3jBo3qrg4CGWbs=; b=gI3Ug9VTn2dMqTOwoWCBOKQI4/nWRCVSd2paJYZkyukrBgpm+IO+ucIcV8kNqonqk2 O6MiKpKMoPBQLt+Rb39f3Jf3iPn8Sz4d9JKtUs8z81pofcNqCb7pqIUh+E2iZkcoGFLm n/qcSO8dV30Qy4VQT8V3dxUG2bTKSju5O7IAHloNuLETaXeld0WALknvGW80Mxuei+bp UrCQF4z15N8vrsXy8XhprKo47cF4z5Q7/PcegPxS/djRA7hMXNQ649uHOWIJBIjqYkru 7u7G52rCANThNfA1EHLMaG5WSlO1zxXRP0BmpRarRN+jv6VqZFC39vPuPU+JI9qxxzeL lieg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b=dajqFc2+; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=ZPRPVuy1; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id bq6-20020a056a000e0600b00681620c8fbesi2433191pfb.393.2023.07.06.17.10.37; Thu, 06 Jul 2023 17:10:52 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@dxuuu.xyz header.s=fm1 header.b=dajqFc2+; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b=ZPRPVuy1; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231779AbjGFX01 (ORCPT + 99 others); Thu, 6 Jul 2023 19:26:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38250 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230466AbjGFX0X (ORCPT ); Thu, 6 Jul 2023 19:26:23 -0400 Received: from out3-smtp.messagingengine.com (out3-smtp.messagingengine.com [66.111.4.27]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AC5981BC3; Thu, 6 Jul 2023 16:26:22 -0700 (PDT) Received: from compute5.internal (compute5.nyi.internal [10.202.2.45]) by mailout.nyi.internal (Postfix) with ESMTP id 2901B5C00E1; Thu, 6 Jul 2023 19:26:22 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute5.internal (MEProxy); Thu, 06 Jul 2023 19:26:22 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to; s=fm1; t=1688685982; x= 1688772382; bh=q+GZB03bv8FWk8Fi1TVDaCiqNoaHfJjJsc6EY7aLdqg=; b=d ajqFc2+WLI+82TWCjXDI3fUTiyA1e5YSIVr/195+w77LRdYDkSQg2IP8uvcqANBQ Bf99hzP2pDhGj0+NtdqC3xgMiFoTPSLDPSpe1+ZIfWuhVsXP5TNoVmCBsIkdaIBo y/aCpmPlftxp+Vg68nYAvAExJg6mEmuWKZg2H4tzDYHAlCU9HZjZl5K3YM+/UOz3 0EQzI2mT9rvzwqKpf5pjRYD7bv+t04AEoWizCZ/8WqN12/GGYUx0q3Ey81UHJ6ga UMiMcqEIRd9Nt4rSSzuqEtwmpP1EgBAuAo1d/cNr0tEGu5AD9519/8dodbPrpr8P deH5gpN3JF3fRLH5g3SmA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:sender:subject:subject:to:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; t=1688685982; x= 1688772382; bh=q+GZB03bv8FWk8Fi1TVDaCiqNoaHfJjJsc6EY7aLdqg=; b=Z PRPVuy1Nnpk7552fuze8F7nRqZCIouBMxVE8pOBjAGtUcDDnb0bUJxw2DbPvx1OK JXwSPAOT00maCUBb+5gH3UKwQhsMrm4B9h7LpHJUsO38IrBN9bHBjKXaImqqciG+ LV0W8q8K4cgs+ewOKK+akonksj3bT6G+rwrrJmEbP3lbiOBoMbPgHDecdxvvgm9A n2sEapu2fAqC2TDbM8IjbjvDZkehGb10fOHFDt0C23sp0jPOaz6sINsYb/KUYAUk jiMCa698yq2I+FPl5DfjKC5VALPC6EyNrai5N7xzOx0jOfBEnSW0U4jCZsgR4Gtu x0ywPn1escick0aqFHetg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedviedrvddtgddvudcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecufghrlhcuvffnffculdejtddmnecujfgurhephffvve fufffkofgjfhgggfestdekredtredttdenucfhrhhomhepffgrnhhivghlucgiuhcuoegu gihusegugihuuhhurdighiiiqeenucggtffrrghtthgvrhhnpefgfefggeejhfduieekvd euteffleeifeeuvdfhheejleejjeekgfffgefhtddtteenucevlhhushhtvghrufhiiigv pedunecurfgrrhgrmhepmhgrihhlfhhrohhmpegugihusegugihuuhhurdighiii X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 6 Jul 2023 19:26:20 -0400 (EDT) From: Daniel Xu To: pabeni@redhat.com, edumazet@google.com, kuba@kernel.org, fw@strlen.de, davem@davemloft.net, pablo@netfilter.org, kadlec@netfilter.org, dsahern@kernel.org, daniel@iogearbox.net Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org Subject: [PATCH bpf-next v2 3/6] netfilter: bpf: Prevent defrag module unload while link active Date: Thu, 6 Jul 2023 17:25:50 -0600 Message-ID: <81ede90e3f1468763ea5b0b6ec2971b7b1b870c1.1688685338.git.dxu@dxuuu.xyz> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS, SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1770718392789433404?= X-GMAIL-MSGID: =?utf-8?q?1770718392789433404?= While in practice we could handle the module being unloaded while a netfilter link (that requested defrag) was active, it's a better user experience to prevent the defrag module from going away. It would violate user expectations if fragmented packets started showing up if some other part of the system tried to unload defrag module. Signed-off-by: Daniel Xu --- include/linux/netfilter.h | 3 +++ net/ipv4/netfilter/nf_defrag_ipv4.c | 1 + net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 1 + net/netfilter/nf_bpf_link.c | 21 +++++++++++++++++++-- 4 files changed, 24 insertions(+), 2 deletions(-) diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index 77a637b681f2..a160dc1e23bf 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -11,6 +11,7 @@ #include #include #include +#include #include #include #include @@ -482,12 +483,14 @@ struct nfnl_ct_hook { extern const struct nfnl_ct_hook __rcu *nfnl_ct_hook; struct nf_defrag_v4_hook { + struct module *owner; int (*enable)(struct net *net); void (*disable)(struct net *net); }; extern const struct nf_defrag_v4_hook __rcu *nf_defrag_v4_hook; struct nf_defrag_v6_hook { + struct module *owner; int (*enable)(struct net *net); void (*disable)(struct net *net); }; diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c index 1f3e0e893b7a..fb133bf3131d 100644 --- a/net/ipv4/netfilter/nf_defrag_ipv4.c +++ b/net/ipv4/netfilter/nf_defrag_ipv4.c @@ -115,6 +115,7 @@ static void __net_exit defrag4_net_exit(struct net *net) } static const struct nf_defrag_v4_hook defrag_hook = { + .owner = THIS_MODULE, .enable = nf_defrag_ipv4_enable, .disable = nf_defrag_ipv4_disable, }; diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c index f7c7ee31c472..29d31721c9c0 100644 --- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c @@ -98,6 +98,7 @@ static void __net_exit defrag6_net_exit(struct net *net) } static const struct nf_defrag_v6_hook defrag_hook = { + .owner = THIS_MODULE, .enable = nf_defrag_ipv6_enable, .disable = nf_defrag_ipv6_disable, }; diff --git a/net/netfilter/nf_bpf_link.c b/net/netfilter/nf_bpf_link.c index 765612cb2370..8ce34696939e 100644 --- a/net/netfilter/nf_bpf_link.c +++ b/net/netfilter/nf_bpf_link.c @@ -2,6 +2,7 @@ #include #include #include +#include #include #include @@ -53,6 +54,12 @@ static int bpf_nf_enable_defrag(struct bpf_nf_link *link) } } + /* Prevent defrag module from going away while in use */ + if (!try_module_get(v4_hook->owner)) { + err = -ENOENT; + goto out_v4; + } + err = v4_hook->enable(link->net); out_v4: rcu_read_unlock(); @@ -79,6 +86,12 @@ static int bpf_nf_enable_defrag(struct bpf_nf_link *link) } } + /* Prevent defrag module from going away while in use */ + if (!try_module_get(v6_hook->owner)) { + err = -ENOENT; + goto out_v6; + } + err = v6_hook->enable(link->net); out_v6: rcu_read_unlock(); @@ -98,8 +111,10 @@ static void bpf_nf_disable_defrag(struct bpf_nf_link *link) rcu_read_lock(); v4_hook = rcu_dereference(nf_defrag_v4_hook); - if (v4_hook) + if (v4_hook) { v4_hook->disable(link->net); + module_put(v4_hook->owner); + } rcu_read_unlock(); break; @@ -110,8 +125,10 @@ static void bpf_nf_disable_defrag(struct bpf_nf_link *link) rcu_read_lock(); v6_hook = rcu_dereference(nf_defrag_v6_hook); - if (v6_hook) + if (v6_hook) { v6_hook->disable(link->net); + module_put(v6_hook->owner); + } rcu_read_unlock(); break;