netfilter: nf_tables: fix scheduling-while-atomic splat

PlaidCat · PlaidCat · commit fedf7f9d1ef7 · 2024-10-15T17:39:58.000-04:00
jira VULN-429 subsystem-sync netfilter:nf_tables 4.18.0-502 commit-author Florian Westphal <fw@strlen.de> commit 2024439 nf_tables_check_loops() can be called from rhashtable list walk so cond_resched() cannot be used here. Fixes: 81ea010 ("netfilter: nf_tables: add rescheduling points during loop detection walks") Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> (cherry picked from commit 2024439) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
@@ -8360,13 +8360,9 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,
 				break;
 			}
 		}
-
-		cond_resched();
 	}
 
 	list_for_each_entry(set, &ctx->table->sets, list) {
-		cond_resched();
-
 		if (!nft_is_active_next(ctx->net, set))
 			continue;
 		if (!(set->flags & NFT_SET_MAP) ||

Original file line number	Diff line number	Diff line change
`@@ -8360,13 +8360,9 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx,`
`8360`	`8360`	`break;`
`8361`	`8361`	`}`
`8362`	`8362`	`}`
`8363`		`-`
`8364`		`- cond_resched();`
`8365`	`8363`	`}`
`8366`	`8364`
`8367`	`8365`	`list_for_each_entry(set, &ctx->table->sets, list) {`
`8368`		`- cond_resched();`
`8369`		`-`
`8370`	`8366`	`if (!nft_is_active_next(ctx->net, set))`
`8371`	`8367`	`continue;`
`8372`	`8368`	`if (!(set->flags & NFT_SET_MAP) \|\|`