eb014de4fd
This patch introduces a list of pending module requests. This new module
list is composed of nft_module_request objects that contain the module
name and one status field that tells if the module has been already
loaded (the 'done' field).
In the first pass, from the preparation phase, the netlink command finds
that a module is missing on this list. Then, a module request is
allocated and added to this list and nft_request_module() returns
-EAGAIN. This triggers the abort path with the autoload parameter set on
from nfnetlink, request_module() is called and the module request enters
the 'done' state. Since the mutex is released when loading modules from
the abort phase, the module list is zapped so this is iteration occurs
over a local list. Therefore, the request_module() calls happen when
object lists are in consistent state (after fulling aborting the
transaction) and the commit list is empty.
On the second pass, the netlink command will find that it already tried
to load the module, so it does not request it again and
nft_request_module() returns 0. Then, there is a look up to find the
object that the command was missing. If the module was successfully
loaded, the command proceeds normally since it finds the missing object
in place, otherwise -ENOENT is reported to userspace.
This patch also updates nfnetlink to include the reason to enter the
abort phase, which is required for this new autoload module rationale.
Fixes: ec7470b834 ("netfilter: nf_tables: store transaction list locally while requesting module")
Reported-by: syzbot+29125d208b3dae9a7019@syzkaller.appspotmail.com
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
69 lines
2.2 KiB
C
69 lines
2.2 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _NFNETLINK_H
|
|
#define _NFNETLINK_H
|
|
|
|
#include <linux/netlink.h>
|
|
#include <linux/capability.h>
|
|
#include <net/netlink.h>
|
|
#include <uapi/linux/netfilter/nfnetlink.h>
|
|
|
|
struct nfnl_callback {
|
|
int (*call)(struct net *net, struct sock *nl, struct sk_buff *skb,
|
|
const struct nlmsghdr *nlh,
|
|
const struct nlattr * const cda[],
|
|
struct netlink_ext_ack *extack);
|
|
int (*call_rcu)(struct net *net, struct sock *nl, struct sk_buff *skb,
|
|
const struct nlmsghdr *nlh,
|
|
const struct nlattr * const cda[],
|
|
struct netlink_ext_ack *extack);
|
|
int (*call_batch)(struct net *net, struct sock *nl, struct sk_buff *skb,
|
|
const struct nlmsghdr *nlh,
|
|
const struct nlattr * const cda[],
|
|
struct netlink_ext_ack *extack);
|
|
const struct nla_policy *policy; /* netlink attribute policy */
|
|
const u_int16_t attr_count; /* number of nlattr's */
|
|
};
|
|
|
|
struct nfnetlink_subsystem {
|
|
const char *name;
|
|
__u8 subsys_id; /* nfnetlink subsystem ID */
|
|
__u8 cb_count; /* number of callbacks */
|
|
const struct nfnl_callback *cb; /* callback for individual types */
|
|
struct module *owner;
|
|
int (*commit)(struct net *net, struct sk_buff *skb);
|
|
int (*abort)(struct net *net, struct sk_buff *skb, bool autoload);
|
|
void (*cleanup)(struct net *net);
|
|
bool (*valid_genid)(struct net *net, u32 genid);
|
|
};
|
|
|
|
int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n);
|
|
int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem *n);
|
|
|
|
int nfnetlink_has_listeners(struct net *net, unsigned int group);
|
|
int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 portid,
|
|
unsigned int group, int echo, gfp_t flags);
|
|
int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error);
|
|
int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid,
|
|
int flags);
|
|
|
|
static inline u16 nfnl_msg_type(u8 subsys, u8 msg_type)
|
|
{
|
|
return subsys << 8 | msg_type;
|
|
}
|
|
|
|
void nfnl_lock(__u8 subsys_id);
|
|
void nfnl_unlock(__u8 subsys_id);
|
|
#ifdef CONFIG_PROVE_LOCKING
|
|
bool lockdep_nfnl_is_held(__u8 subsys_id);
|
|
#else
|
|
static inline bool lockdep_nfnl_is_held(__u8 subsys_id)
|
|
{
|
|
return true;
|
|
}
|
|
#endif /* CONFIG_PROVE_LOCKING */
|
|
|
|
#define MODULE_ALIAS_NFNL_SUBSYS(subsys) \
|
|
MODULE_ALIAS("nfnetlink-subsys-" __stringify(subsys))
|
|
|
|
#endif /* _NFNETLINK_H */
|