5.15-stable patches

added patches:
	netfilter-conntrack-avoid-useless-indirection-during-conntrack-destruction.patch

diff --git a/queue-5.15/netfilter-conntrack-avoid-useless-indirection-during-conntrack-destruction.patch b/queue-5.15/netfilter-conntrack-avoid-useless-indirection-during-conntrack-destruction.patch
new file mode 100644 (file)
index 0000000..8ae910d
--- /dev/null
+++ b/queue-5.15/netfilter-conntrack-avoid-useless-indirection-during-conntrack-destruction.patch
@@ -0,0 +1,119 @@
+From 6ae7989c9af0d98ab64196f4f4c6f6499454bd23 Mon Sep 17 00:00:00 2001
+From: Florian Westphal <fw@strlen.de>
+Date: Fri, 7 Jan 2022 05:03:25 +0100
+Subject: netfilter: conntrack: avoid useless indirection during conntrack destruction
+
+From: Florian Westphal <fw@strlen.de>
+
+commit 6ae7989c9af0d98ab64196f4f4c6f6499454bd23 upstream.
+
+nf_ct_put() results in a usesless indirection:
+
+nf_ct_put -> nf_conntrack_put -> nf_conntrack_destroy -> rcu readlock +
+indirect call of ct_hooks->destroy().
+
+There are two _put helpers:
+nf_ct_put and nf_conntrack_put.  The latter is what should be used in
+code that MUST NOT cause a linker dependency on the conntrack module
+(e.g. calls from core network stack).
+
+Everyone else should call nf_ct_put() instead.
+
+A followup patch will convert a few nf_conntrack_put() calls to
+nf_ct_put(), in particular from modules that already have a conntrack
+dependency such as act_ct or even nf_conntrack itself.
+
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/netfilter/nf_conntrack_common.h |    2 ++
+ include/net/netfilter/nf_conntrack.h          |    8 ++++++--
+ net/netfilter/nf_conntrack_core.c             |   12 ++++++------
+ 3 files changed, 14 insertions(+), 8 deletions(-)
+
+--- a/include/linux/netfilter/nf_conntrack_common.h
++++ b/include/linux/netfilter/nf_conntrack_common.h
+@@ -29,6 +29,8 @@ struct nf_conntrack {
+ };
+ 
+ void nf_conntrack_destroy(struct nf_conntrack *nfct);
++
++/* like nf_ct_put, but without module dependency on nf_conntrack */
+ static inline void nf_conntrack_put(struct nf_conntrack *nfct)
+ {
+       if (nfct && atomic_dec_and_test(&nfct->use))
+--- a/include/net/netfilter/nf_conntrack.h
++++ b/include/net/netfilter/nf_conntrack.h
+@@ -76,6 +76,8 @@ struct nf_conn {
+        * Hint, SKB address this struct and refcnt via skb->_nfct and
+        * helpers nf_conntrack_get() and nf_conntrack_put().
+        * Helper nf_ct_put() equals nf_conntrack_put() by dec refcnt,
++       * except that the latter uses internal indirection and does not
++       * result in a conntrack module dependency.
+        * beware nf_ct_get() is different and don't inc refcnt.
+        */
+       struct nf_conntrack ct_general;
+@@ -169,11 +171,13 @@ nf_ct_get(const struct sk_buff *skb, enu
+       return (struct nf_conn *)(nfct & NFCT_PTRMASK);
+ }
+ 
++void nf_ct_destroy(struct nf_conntrack *nfct);
++
+ /* decrement reference count on a conntrack */
+ static inline void nf_ct_put(struct nf_conn *ct)
+ {
+-      WARN_ON(!ct);
+-      nf_conntrack_put(&ct->ct_general);
++      if (ct && refcount_dec_and_test(&ct->ct_general.use))
++              nf_ct_destroy(&ct->ct_general);
+ }
+ 
+ /* Protocol module loading */
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -571,7 +571,7 @@ static void nf_ct_del_from_dying_or_unco
+ 
+ #define NFCT_ALIGN(len)       (((len) + NFCT_INFOMASK) & ~NFCT_INFOMASK)
+ 
+-/* Released via destroy_conntrack() */
++/* Released via nf_ct_destroy() */
+ struct nf_conn *nf_ct_tmpl_alloc(struct net *net,
+                                const struct nf_conntrack_zone *zone,
+                                gfp_t flags)
+@@ -625,12 +625,11 @@ static void destroy_gre_conntrack(struct
+ #endif
+ }
+ 
+-static void
+-destroy_conntrack(struct nf_conntrack *nfct)
++void nf_ct_destroy(struct nf_conntrack *nfct)
+ {
+       struct nf_conn *ct = (struct nf_conn *)nfct;
+ 
+-      pr_debug("destroy_conntrack(%p)\n", ct);
++      pr_debug("%s(%p)\n", __func__, ct);
+       WARN_ON(atomic_read(&nfct->use) != 0);
+ 
+       if (unlikely(nf_ct_is_template(ct))) {
+@@ -656,9 +655,10 @@ destroy_conntrack(struct nf_conntrack *n
+       if (ct->master)
+               nf_ct_put(ct->master);
+ 
+-      pr_debug("destroy_conntrack: returning ct=%p to slab\n", ct);
++      pr_debug("%s: returning ct=%p to slab\n", __func__, ct);
+       nf_conntrack_free(ct);
+ }
++EXPORT_SYMBOL(nf_ct_destroy);
+ 
+ static void nf_ct_delete_from_lists(struct nf_conn *ct)
+ {
+@@ -2825,7 +2825,7 @@ err_cachep:
+ 
+ static struct nf_ct_hook nf_conntrack_hook = {
+       .update         = nf_conntrack_update,
+-      .destroy        = destroy_conntrack,
++      .destroy        = nf_ct_destroy,
+       .get_tuple_skb  = nf_conntrack_get_tuple_skb,
+ };
+ 

diff --git a/queue-5.15/series b/queue-5.15/series
index fa0e7b5523241baeca2ebe48f065ab7be2570527..25814941f140918a3f0a2dde8cd4bb0b05f629a1 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -108,3 +108,4 @@ kvm-x86-pmu-update-amd-pmc-sample-period-to-fix-guest-nmi-watchdog.patch
 kvm-x86-pend-kvm_req_apicv_update-during-vcpu-creation-to-fix-a-race.patch
 kvm-nvmx-defer-apicv-updates-while-l2-is-active-until-l1-is-active.patch
 kvm-svm-flush-when-freeing-encrypted-pages-even-on-sme_coherent-cpus.patch
+netfilter-conntrack-avoid-useless-indirection-during-conntrack-destruction.patch