tmakin/ack-tegra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: nf_tables: annotate data-races around element expiration

Browse Source 
element expiration can be read-write locklessly, it can be written by
dynset and read from netlink dump, add annotation.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso
2024-09-03 01:08:58 +02:00
parent c5ad8ed61f
commit 73d3c04b71
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/net/netfilter/nf_tables.h
+1 -1
View File
@@ -835,7 +835,7 @@ static inline bool __nft_set_elem_expired(const struct nft_set_ext *ext,
u64 tstamp)
{
return nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION) &&
time_after_eq64(tstamp, *nft_set_ext_expiration(ext));
time_after_eq64(tstamp, READ_ONCE(*nft_set_ext_expiration(ext)));
}
static inline bool nft_set_elem_expired(const struct nft_set_ext *ext)
net/netfilter/nf_tables_api.c
+1 -1
View File
@@ -5827,7 +5827,7 @@ static int nf_tables_fill_setelem(struct sk_buff *skb,
if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
u64 expires, now = get_jiffies_64();
expires = *nft_set_ext_expiration(ext);
expires = READ_ONCE(*nft_set_ext_expiration(ext));
if (time_before64(now, expires))
expires -= now;
else
net/netfilter/nft_dynset.c
+1 -1
View File
@@ -96,7 +96,7 @@ void nft_dynset_eval(const struct nft_expr *expr,
if (priv->op == NFT_DYNSET_OP_UPDATE &&
nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
timeout = priv->timeout ? : READ_ONCE(set->timeout);
*nft_set_ext_expiration(ext) = get_jiffies_64() + timeout;
WRITE_ONCE(*nft_set_ext_expiration(ext), get_jiffies_64() + timeout);
}
nft_set_elem_update_expr(ext, regs, pkt);