Pablo Neira Ayuso c03d278fdf netfilter: nf_tables: wait for rcu grace period on net_device removal ... 8c873e2199 ("netfilter: core: free hooks with call_rcu") removed synchronize_net() call when unregistering basechain hook, however, net_device removal event handler for the NFPROTO_NETDEV was not updated to wait for RCU grace period. Note that 835b803377 ("netfilter: nf_tables_netdev: unregister hooks on net_device removal") does not remove basechain rules on device removal, I was hinted to remove rules on net_device removal later, see 5ebe0b0eec ("netfilter: nf_tables: destroy basechain and rules on netdevice removal"). Although NETDEV_UNREGISTER event is guaranteed to be handled after synchronize_net() call, this path needs to wait for rcu grace period via rcu callback to release basechain hooks if netns is alive because an ongoing netlink dump could be in progress (sockets hold a reference on the netns). Note that nf_tables_pre_exit_net() unregisters and releases basechain hooks but it is possible to see NETDEV_UNREGISTER at a later stage in the netns exit path, eg. veth peer device in another netns: cleanup_net() default_device_exit_batch() unregister_netdevice_many_notify() notifier_call_chain() nf_tables_netdev_event() __nft_release_basechain() In this particular case, same rule of thumb applies: if netns is alive, then wait for rcu grace period because netlink dump in the other netns could be in progress. Otherwise, if the other netns is going away then no netlink dump can be in progress and basechain hooks can be released inmediately. While at it, turn WARN_ON() into WARN_ON_ONCE() for the basechain validation, which should not ever happen. Fixes: 835b803377 ("netfilter: nf_tables_netdev: unregister hooks on net_device removal") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2024-11-07 12:28:47 +01:00
..
ipset
ipvs	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
core.c	net/netfilter: make use of the helper macro LIST_HEAD()	2024-09-06 18:10:21 -07:00
Kconfig
Makefile	netfilter: Add bpf_xdp_flow_lookup kfunc	2024-07-01 17:03:01 +02:00
nf_bpf_link.c	Including fixes from netfiler, xfrm and bluetooth.	2024-10-24 16:43:50 -07:00
nf_conncount.c	netfilter: move nf_ct_netns_get out of nf_conncount_init	2024-08-19 18:44:51 +02:00
nf_conntrack_acct.c
nf_conntrack_amanda.c
nf_conntrack_bpf.c
nf_conntrack_broadcast.c
nf_conntrack_core.c	netfilter: nfnetlink_queue: remove old clash resolution logic	2024-09-26 13:03:03 +02:00
nf_conntrack_ecache.c
nf_conntrack_expect.c
nf_conntrack_extend.c
nf_conntrack_ftp.c
nf_conntrack_h323_asn1.c
nf_conntrack_h323_main.c
nf_conntrack_h323_types.c
nf_conntrack_helper.c
nf_conntrack_irc.c
nf_conntrack_labels.c
nf_conntrack_netbios_ns.c
nf_conntrack_netlink.c	netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS	2024-09-26 13:03:02 +02:00
nf_conntrack_ovs.c
nf_conntrack_pptp.c
nf_conntrack_proto_dccp.c
nf_conntrack_proto_generic.c
nf_conntrack_proto_gre.c
nf_conntrack_proto_icmp.c
nf_conntrack_proto_icmpv6.c
nf_conntrack_proto_sctp.c
nf_conntrack_proto_tcp.c	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
nf_conntrack_proto_udp.c
nf_conntrack_proto.c
nf_conntrack_sane.c
nf_conntrack_seqadj.c
nf_conntrack_sip.c
nf_conntrack_snmp.c
nf_conntrack_standalone.c	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
nf_conntrack_tftp.c
nf_conntrack_timeout.c
nf_conntrack_timestamp.c
nf_dup_netdev.c
nf_flow_table_bpf.c	netfilter: Add bpf_xdp_flow_lookup kfunc	2024-07-01 17:03:01 +02:00
nf_flow_table_core.c	net: netfilter: move nf flowtable bpf initialization in nf_flow_table_module_init()	2024-09-12 15:41:03 +02:00
nf_flow_table_inet.c	net: netfilter: move nf flowtable bpf initialization in nf_flow_table_module_init()	2024-09-12 15:41:03 +02:00
nf_flow_table_ip.c	netfilter: flowtable: validate vlan header	2024-08-22 12:14:18 +02:00
nf_flow_table_offload.c	netfilter: flowtable: initialise extack before use	2024-08-14 23:37:16 +02:00
nf_flow_table_procfs.c
nf_flow_table_xdp.c	netfilter: nf_tables: Add flowtable map for xdp offload	2024-07-01 17:01:53 +02:00
nf_hooks_lwtunnel.c	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
nf_internals.h
nf_log_syslog.c
nf_log.c	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
nf_nat_amanda.c
nf_nat_bpf.c
nf_nat_core.c	netfilter: nfnetlink_queue: remove old clash resolution logic	2024-09-26 13:03:03 +02:00
nf_nat_ftp.c
nf_nat_helper.c
nf_nat_irc.c
nf_nat_masquerade.c
nf_nat_ovs.c
nf_nat_proto.c
nf_nat_redirect.c
nf_nat_sip.c
nf_nat_tftp.c
nf_queue.c
nf_sockopt.c
nf_synproxy_core.c	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
nf_tables_api.c	netfilter: nf_tables: wait for rcu grace period on net_device removal	2024-11-07 12:28:47 +01:00
nf_tables_core.c	netfilter: nf_tables: don't initialize registers in nft_do_chain()	2024-08-20 12:37:25 +02:00
nf_tables_offload.c
nf_tables_trace.c
nfnetlink_acct.c
nfnetlink_cthelper.c
nfnetlink_cttimeout.c
nfnetlink_hook.c
nfnetlink_log.c
nfnetlink_osf.c
nfnetlink_queue.c	netfilter: nfnetlink_queue: unbreak SCTP traffic	2024-08-19 18:44:50 +02:00
nfnetlink.c	netfilter: nfnetlink: convert kfree_skb to consume_skb	2024-08-19 18:44:50 +02:00
nft_bitwise.c	netfilter: nf_tables: pass context structure to nft_parse_register_load	2024-08-20 12:37:24 +02:00
nft_byteorder.c	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
nft_chain_filter.c
nft_chain_nat.c
nft_chain_route.c
nft_cmp.c	netfilter: nf_tables: pass context structure to nft_parse_register_load	2024-08-20 12:37:24 +02:00
nft_compat.c	netfilter: nf_tables: missing objects with no memcg accounting	2024-09-26 13:03:02 +02:00
nft_connlimit.c
nft_counter.c	netfilter: nft_counter: Use u64_stats_t for statistic.	2024-09-03 10:47:16 +02:00
nft_ct_fast.c
nft_ct.c	netfilter: nf_tables: pass context structure to nft_parse_register_load	2024-08-20 12:37:24 +02:00
nft_dup_netdev.c	netfilter: nf_tables: pass context structure to nft_parse_register_load	2024-08-20 12:37:24 +02:00
nft_dynset.c	netfilter: nf_tables: set element timeout update support	2024-09-03 18:19:44 +02:00
nft_exthdr.c	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
nft_fib_inet.c
nft_fib_netdev.c
nft_fib.c	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_flow_offload.c	netfilter: nft_flow_offload: Unmask upper DSCP bits in nft_flow_route()	2024-09-09 14:14:53 +01:00
nft_fwd_netdev.c	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_hash.c	netfilter: nf_tables: pass context structure to nft_parse_register_load	2024-08-20 12:37:24 +02:00
nft_immediate.c	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_inner.c
nft_last.c
nft_limit.c
nft_log.c	netfilter: nf_tables: missing objects with no memcg accounting	2024-09-26 13:03:02 +02:00
nft_lookup.c	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_masq.c	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_meta.c	netfilter: nf_tables: missing objects with no memcg accounting	2024-09-26 13:03:02 +02:00
nft_nat.c	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_numgen.c	netfilter: nf_tables: missing objects with no memcg accounting	2024-09-26 13:03:02 +02:00
nft_objref.c	netfilter: nf_tables: pass context structure to nft_parse_register_load	2024-08-20 12:37:24 +02:00
nft_osf.c	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_payload.c	netfilter: nft_payload: sanitize offset and length before calling skb_checksum()	2024-10-31 10:54:49 +01:00
nft_queue.c	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_quota.c
nft_range.c	netfilter: nf_tables: pass context structure to nft_parse_register_load	2024-08-20 12:37:24 +02:00
nft_redir.c	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_reject_inet.c	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_reject_netdev.c	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_reject.c	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_rt.c	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_set_bitmap.c
nft_set_hash.c
nft_set_pipapo_avx2.c	netfilter: nft_set_pipapo_avx2: disable softinterrupts	2024-07-24 10:01:59 +02:00
nft_set_pipapo_avx2.h
nft_set_pipapo.c	netfilter: nf_tables: missing objects with no memcg accounting	2024-09-26 13:03:02 +02:00
nft_set_pipapo.h	netfilter: nf_set_pipapo: fix initial map fill	2024-07-17 19:00:47 +02:00
nft_set_rbtree.c
nft_socket.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2024-09-15 09:13:19 -07:00
nft_synproxy.c	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_tproxy.c	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_tunnel.c	netfilter: nf_tables: missing objects with no memcg accounting	2024-09-26 13:03:02 +02:00
nft_xfrm.c	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
utils.c
x_tables.c	netfilter: Fix use-after-free in get_info()	2024-10-30 13:17:36 +01:00
xt_addrtype.c	netfilter: xtables: avoid NFPROTO_UNSPEC where needed	2024-10-09 23:20:46 +02:00
xt_AUDIT.c
xt_bpf.c
xt_cgroup.c
xt_CHECKSUM.c	netfilter: xtables: avoid NFPROTO_UNSPEC where needed	2024-10-09 23:20:46 +02:00
xt_CLASSIFY.c	netfilter: xtables: avoid NFPROTO_UNSPEC where needed	2024-10-09 23:20:46 +02:00
xt_cluster.c	netfilter: xtables: avoid NFPROTO_UNSPEC where needed	2024-10-09 23:20:46 +02:00
xt_comment.c
xt_connbytes.c	netfilter: xtables: avoid NFPROTO_UNSPEC where needed	2024-10-09 23:20:46 +02:00
xt_connlabel.c
xt_connlimit.c	netfilter: xtables: avoid NFPROTO_UNSPEC where needed	2024-10-09 23:20:46 +02:00
xt_connmark.c	netfilter: xtables: avoid NFPROTO_UNSPEC where needed	2024-10-09 23:20:46 +02:00
xt_CONNSECMARK.c	netfilter: xtables: avoid NFPROTO_UNSPEC where needed	2024-10-09 23:20:46 +02:00
xt_conntrack.c
xt_cpu.c
xt_CT.c	netfilter: xtables: avoid NFPROTO_UNSPEC where needed	2024-10-09 23:20:46 +02:00
xt_dccp.c
xt_devgroup.c
xt_dscp.c
xt_DSCP.c
xt_ecn.c
xt_esp.c
xt_hashlimit.c
xt_helper.c
xt_hl.c
xt_HL.c
xt_HMARK.c
xt_IDLETIMER.c	netfilter: xtables: avoid NFPROTO_UNSPEC where needed	2024-10-09 23:20:46 +02:00
xt_ipcomp.c
xt_iprange.c
xt_ipvs.c
xt_l2tp.c
xt_LED.c	netfilter: xtables: avoid NFPROTO_UNSPEC where needed	2024-10-09 23:20:46 +02:00
xt_length.c
xt_limit.c
xt_LOG.c
xt_mac.c
xt_mark.c	netfilter: xtables: fix typo causing some targets not to load on IPv6	2024-10-21 11:31:26 +02:00
xt_MASQUERADE.c
xt_multiport.c
xt_nat.c
xt_NETMAP.c
xt_nfacct.c
xt_NFLOG.c	netfilter: xtables: fix typo causing some targets not to load on IPv6	2024-10-21 11:31:26 +02:00
xt_NFQUEUE.c
xt_osf.c
xt_owner.c
xt_physdev.c
xt_pkttype.c
xt_policy.c
xt_quota.c
xt_rateest.c
xt_RATEEST.c	netfilter: xtables: avoid NFPROTO_UNSPEC where needed	2024-10-09 23:20:46 +02:00
xt_realm.c
xt_recent.c	netfilter: xt_recent: Lift restrictions on max hitcount value	2024-06-28 17:57:50 +02:00
xt_REDIRECT.c
xt_repldata.h
xt_sctp.c
xt_SECMARK.c	netfilter: xtables: avoid NFPROTO_UNSPEC where needed	2024-10-09 23:20:46 +02:00
xt_set.c
xt_socket.c
xt_state.c
xt_statistic.c
xt_string.c
xt_tcpmss.c
xt_TCPMSS.c
xt_TCPOPTSTRIP.c
xt_tcpudp.c
xt_TEE.c
xt_time.c
xt_TPROXY.c
xt_TRACE.c	netfilter: xtables: fix typo causing some targets not to load on IPv6	2024-10-21 11:31:26 +02:00
xt_u32.c