Skip to content

Commit 259c4e8

Browse files
Florian Westphalgregkh
Florian Westphal
authored and
gregkh
committed
netfilter: nf_tables: place base_seq in struct net
[ Upstream commit 64102d9 ] This will soon be read from packet path around same time as the gencursor. Both gencursor and base_seq get incremented almost at the same time, so it makes sense to place them in the same structure. This doesn't increase struct net size on 64bit due to padding. Signed-off-by: Florian Westphal <fw@strlen.de> Stable-dep-of: b2f742c ("netfilter: nf_tables: restart set lookup on base_seq change") Signed-off-by: Sasha Levin <sashal@kernel.org>
1 parent dbe85d3 commit 259c4e8

File tree

3 files changed

+34
-33
lines changed

3 files changed

+34
-33
lines changed

‎include/net/netfilter/nf_tables.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1909,7 +1909,6 @@ struct nftables_pernet {
19091909
struct mutex commit_mutex;
19101910
u64 table_handle;
19111911
u64 tstamp;
1912-
unsigned int base_seq;
19131912
unsigned int gc_seq;
19141913
u8 validate_state;
19151914
struct work_struct destroy_work;

‎include/net/netns/nftables.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
#define _NETNS_NFTABLES_H_
44

55
struct netns_nftables {
6+
unsigned int base_seq;
67
u8 gencursor;
78
};
89

‎net/netfilter/nf_tables_api.c‎

Lines changed: 33 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -995,11 +995,14 @@ nf_tables_chain_type_lookup(struct net *net, const struct nlattr *nla,
995995
return ERR_PTR(-ENOENT);
996996
}
997997

998-
static __be16 nft_base_seq(const struct net *net)
998+
static unsigned int nft_base_seq(const struct net *net)
999999
{
1000-
struct nftables_pernet *nft_net = nft_pernet(net);
1000+
return READ_ONCE(net->nft.base_seq);
1001+
}
10011002

1002-
return htons(nft_net->base_seq & 0xffff);
1003+
static __be16 nft_base_seq_be16(const struct net *net)
1004+
{
1005+
return htons(nft_base_seq(net) & 0xffff);
10031006
}
10041007

10051008
static const struct nla_policy nft_table_policy[NFTA_TABLE_MAX + 1] = {
@@ -1019,7 +1022,7 @@ static int nf_tables_fill_table_info(struct sk_buff *skb, struct net *net,
10191022

10201023
nlh = nfnl_msg_put(skb, portid, seq,
10211024
nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event),
1022-
flags, family, NFNETLINK_V0, nft_base_seq(net));
1025+
flags, family, NFNETLINK_V0, nft_base_seq_be16(net));
10231026
if (!nlh)
10241027
goto nla_put_failure;
10251028

@@ -1112,7 +1115,7 @@ static int nf_tables_dump_tables(struct sk_buff *skb,
11121115

11131116
rcu_read_lock();
11141117
nft_net = nft_pernet(net);
1115-
cb->seq = READ_ONCE(nft_net->base_seq);
1118+
cb->seq = nft_base_seq(net);
11161119

11171120
list_for_each_entry_rcu(table, &nft_net->tables, list) {
11181121
if (family != NFPROTO_UNSPEC && family != table->family)
@@ -1880,7 +1883,7 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
18801883

18811884
nlh = nfnl_msg_put(skb, portid, seq,
18821885
nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event),
1883-
flags, family, NFNETLINK_V0, nft_base_seq(net));
1886+
flags, family, NFNETLINK_V0, nft_base_seq_be16(net));
18841887
if (!nlh)
18851888
goto nla_put_failure;
18861889

@@ -1983,7 +1986,7 @@ static int nf_tables_dump_chains(struct sk_buff *skb,
19831986

19841987
rcu_read_lock();
19851988
nft_net = nft_pernet(net);
1986-
cb->seq = READ_ONCE(nft_net->base_seq);
1989+
cb->seq = nft_base_seq(net);
19871990

19881991
list_for_each_entry_rcu(table, &nft_net->tables, list) {
19891992
if (family != NFPROTO_UNSPEC && family != table->family)
@@ -3480,7 +3483,7 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net,
34803483
u16 type = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
34813484

34823485
nlh = nfnl_msg_put(skb, portid, seq, type, flags, family, NFNETLINK_V0,
3483-
nft_base_seq(net));
3486+
nft_base_seq_be16(net));
34843487
if (!nlh)
34853488
goto nla_put_failure;
34863489

@@ -3648,7 +3651,7 @@ static int nf_tables_dump_rules(struct sk_buff *skb,
36483651

36493652
rcu_read_lock();
36503653
nft_net = nft_pernet(net);
3651-
cb->seq = READ_ONCE(nft_net->base_seq);
3654+
cb->seq = nft_base_seq(net);
36523655

36533656
list_for_each_entry_rcu(table, &nft_net->tables, list) {
36543657
if (family != NFPROTO_UNSPEC && family != table->family)
@@ -3859,7 +3862,7 @@ static int nf_tables_getrule_reset(struct sk_buff *skb,
38593862
buf = kasprintf(GFP_ATOMIC, "%.*s:%u",
38603863
nla_len(nla[NFTA_RULE_TABLE]),
38613864
(char *)nla_data(nla[NFTA_RULE_TABLE]),
3862-
nft_net->base_seq);
3865+
nft_base_seq(net));
38633866
audit_log_nfcfg(buf, info->nfmsg->nfgen_family, 1,
38643867
AUDIT_NFT_OP_RULE_RESET, GFP_ATOMIC);
38653868
kfree(buf);
@@ -4670,7 +4673,7 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx,
46704673
nlh = nfnl_msg_put(skb, portid, seq,
46714674
nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event),
46724675
flags, ctx->family, NFNETLINK_V0,
4673-
nft_base_seq(ctx->net));
4676+
nft_base_seq_be16(ctx->net));
46744677
if (!nlh)
46754678
goto nla_put_failure;
46764679

@@ -4812,7 +4815,7 @@ static int nf_tables_dump_sets(struct sk_buff *skb, struct netlink_callback *cb)
48124815

48134816
rcu_read_lock();
48144817
nft_net = nft_pernet(net);
4815-
cb->seq = READ_ONCE(nft_net->base_seq);
4818+
cb->seq = nft_base_seq(net);
48164819

48174820
list_for_each_entry_rcu(table, &nft_net->tables, list) {
48184821
if (ctx->family != NFPROTO_UNSPEC &&
@@ -5988,7 +5991,7 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
59885991

59895992
rcu_read_lock();
59905993
nft_net = nft_pernet(net);
5991-
cb->seq = READ_ONCE(nft_net->base_seq);
5994+
cb->seq = nft_base_seq(net);
59925995

59935996
list_for_each_entry_rcu(table, &nft_net->tables, list) {
59945997
if (dump_ctx->ctx.family != NFPROTO_UNSPEC &&
@@ -6017,7 +6020,7 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
60176020
seq = cb->nlh->nlmsg_seq;
60186021

60196022
nlh = nfnl_msg_put(skb, portid, seq, event, NLM_F_MULTI,
6020-
table->family, NFNETLINK_V0, nft_base_seq(net));
6023+
table->family, NFNETLINK_V0, nft_base_seq_be16(net));
60216024
if (!nlh)
60226025
goto nla_put_failure;
60236026

@@ -6110,7 +6113,7 @@ static int nf_tables_fill_setelem_info(struct sk_buff *skb,
61106113

61116114
event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event);
61126115
nlh = nfnl_msg_put(skb, portid, seq, event, flags, ctx->family,
6113-
NFNETLINK_V0, nft_base_seq(ctx->net));
6116+
NFNETLINK_V0, nft_base_seq_be16(ctx->net));
61146117
if (!nlh)
61156118
goto nla_put_failure;
61166119

@@ -6409,7 +6412,7 @@ static int nf_tables_getsetelem_reset(struct sk_buff *skb,
64096412
}
64106413
nelems++;
64116414
}
6412-
audit_log_nft_set_reset(dump_ctx.ctx.table, nft_net->base_seq, nelems);
6415+
audit_log_nft_set_reset(dump_ctx.ctx.table, nft_base_seq(info->net), nelems);
64136416

64146417
out_unlock:
64156418
rcu_read_unlock();
@@ -8012,7 +8015,7 @@ static int nf_tables_fill_obj_info(struct sk_buff *skb, struct net *net,
80128015

80138016
nlh = nfnl_msg_put(skb, portid, seq,
80148017
nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event),
8015-
flags, family, NFNETLINK_V0, nft_base_seq(net));
8018+
flags, family, NFNETLINK_V0, nft_base_seq_be16(net));
80168019
if (!nlh)
80178020
goto nla_put_failure;
80188021

@@ -8077,7 +8080,7 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
80778080

80788081
rcu_read_lock();
80798082
nft_net = nft_pernet(net);
8080-
cb->seq = READ_ONCE(nft_net->base_seq);
8083+
cb->seq = nft_base_seq(net);
80818084

80828085
list_for_each_entry_rcu(table, &nft_net->tables, list) {
80838086
if (family != NFPROTO_UNSPEC && family != table->family)
@@ -8111,7 +8114,7 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
81118114
idx++;
81128115
}
81138116
if (ctx->reset && entries)
8114-
audit_log_obj_reset(table, nft_net->base_seq, entries);
8117+
audit_log_obj_reset(table, nft_base_seq(net), entries);
81158118
if (rc < 0)
81168119
break;
81178120
}
@@ -8280,7 +8283,7 @@ static int nf_tables_getobj_reset(struct sk_buff *skb,
82808283
buf = kasprintf(GFP_ATOMIC, "%.*s:%u",
82818284
nla_len(nla[NFTA_OBJ_TABLE]),
82828285
(char *)nla_data(nla[NFTA_OBJ_TABLE]),
8283-
nft_net->base_seq);
8286+
nft_base_seq(net));
82848287
audit_log_nfcfg(buf, info->nfmsg->nfgen_family, 1,
82858288
AUDIT_NFT_OP_OBJ_RESET, GFP_ATOMIC);
82868289
kfree(buf);
@@ -8385,9 +8388,8 @@ void nft_obj_notify(struct net *net, const struct nft_table *table,
83858388
struct nft_object *obj, u32 portid, u32 seq, int event,
83868389
u16 flags, int family, int report, gfp_t gfp)
83878390
{
8388-
struct nftables_pernet *nft_net = nft_pernet(net);
83898391
char *buf = kasprintf(gfp, "%s:%u",
8390-
table->name, nft_net->base_seq);
8392+
table->name, nft_base_seq(net));
83918393

83928394
audit_log_nfcfg(buf,
83938395
family,
@@ -9036,7 +9038,7 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
90369038

90379039
nlh = nfnl_msg_put(skb, portid, seq,
90389040
nfnl_msg_type(NFNL_SUBSYS_NFTABLES, event),
9039-
flags, family, NFNETLINK_V0, nft_base_seq(net));
9041+
flags, family, NFNETLINK_V0, nft_base_seq_be16(net));
90409042
if (!nlh)
90419043
goto nla_put_failure;
90429044

@@ -9104,7 +9106,7 @@ static int nf_tables_dump_flowtable(struct sk_buff *skb,
91049106

91059107
rcu_read_lock();
91069108
nft_net = nft_pernet(net);
9107-
cb->seq = READ_ONCE(nft_net->base_seq);
9109+
cb->seq = nft_base_seq(net);
91089110

91099111
list_for_each_entry_rcu(table, &nft_net->tables, list) {
91109112
if (family != NFPROTO_UNSPEC && family != table->family)
@@ -9289,17 +9291,16 @@ static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable)
92899291
static int nf_tables_fill_gen_info(struct sk_buff *skb, struct net *net,
92909292
u32 portid, u32 seq)
92919293
{
9292-
struct nftables_pernet *nft_net = nft_pernet(net);
92939294
struct nlmsghdr *nlh;
92949295
char buf[TASK_COMM_LEN];
92959296
int event = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWGEN);
92969297

92979298
nlh = nfnl_msg_put(skb, portid, seq, event, 0, AF_UNSPEC,
9298-
NFNETLINK_V0, nft_base_seq(net));
9299+
NFNETLINK_V0, nft_base_seq_be16(net));
92999300
if (!nlh)
93009301
goto nla_put_failure;
93019302

9302-
if (nla_put_be32(skb, NFTA_GEN_ID, htonl(nft_net->base_seq)) ||
9303+
if (nla_put_be32(skb, NFTA_GEN_ID, htonl(nft_base_seq(net))) ||
93039304
nla_put_be32(skb, NFTA_GEN_PROC_PID, htonl(task_pid_nr(current))) ||
93049305
nla_put_string(skb, NFTA_GEN_PROC_NAME, get_task_comm(buf, current)))
93059306
goto nla_put_failure;
@@ -10462,11 +10463,11 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
1046210463
* Bump generation counter, invalidate any dump in progress.
1046310464
* Cannot fail after this point.
1046410465
*/
10465-
base_seq = READ_ONCE(nft_net->base_seq);
10466+
base_seq = nft_base_seq(net);
1046610467
while (++base_seq == 0)
1046710468
;
1046810469

10469-
WRITE_ONCE(nft_net->base_seq, base_seq);
10470+
WRITE_ONCE(net->nft.base_seq, base_seq);
1047010471

1047110472
gc_seq = nft_gc_seq_begin(nft_net);
1047210473

@@ -10698,7 +10699,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
1069810699

1069910700
nft_commit_notify(net, NETLINK_CB(skb).portid);
1070010701
nf_tables_gen_notify(net, skb, NFT_MSG_NEWGEN);
10701-
nf_tables_commit_audit_log(&adl, nft_net->base_seq);
10702+
nf_tables_commit_audit_log(&adl, nft_base_seq(net));
1070210703

1070310704
nft_gc_seq_end(nft_net, gc_seq);
1070410705
nft_net->validate_state = NFT_VALIDATE_SKIP;
@@ -11032,7 +11033,7 @@ static bool nf_tables_valid_genid(struct net *net, u32 genid)
1103211033
mutex_lock(&nft_net->commit_mutex);
1103311034
nft_net->tstamp = get_jiffies_64();
1103411035

11035-
genid_ok = genid == 0 || nft_net->base_seq == genid;
11036+
genid_ok = genid == 0 || nft_base_seq(net) == genid;
1103611037
if (!genid_ok)
1103711038
mutex_unlock(&nft_net->commit_mutex);
1103811039

@@ -11710,7 +11711,7 @@ static int __net_init nf_tables_init_net(struct net *net)
1171011711
INIT_LIST_HEAD(&nft_net->module_list);
1171111712
INIT_LIST_HEAD(&nft_net->notify_list);
1171211713
mutex_init(&nft_net->commit_mutex);
11713-
nft_net->base_seq = 1;
11714+
net->nft.base_seq = 1;
1171411715
nft_net->gc_seq = 0;
1171511716
nft_net->validate_state = NFT_VALIDATE_SKIP;
1171611717
INIT_WORK(&nft_net->destroy_work, nf_tables_trans_destroy_work);

0 commit comments

Comments
 (0)