From: Greg Kroah-Hartman Date: Mon, 25 Apr 2022 11:41:15 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v4.9.312~33 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6480069d2c433877f49be345cec2664f68d7ffd8;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: netfilter-conntrack-avoid-useless-indirection-during-conntrack-destruction.patch --- diff --git a/queue-5.15/netfilter-conntrack-avoid-useless-indirection-during-conntrack-destruction.patch b/queue-5.15/netfilter-conntrack-avoid-useless-indirection-during-conntrack-destruction.patch new file mode 100644 index 00000000000..8ae910dd2a8 --- /dev/null +++ b/queue-5.15/netfilter-conntrack-avoid-useless-indirection-during-conntrack-destruction.patch @@ -0,0 +1,119 @@ +From 6ae7989c9af0d98ab64196f4f4c6f6499454bd23 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Fri, 7 Jan 2022 05:03:25 +0100 +Subject: netfilter: conntrack: avoid useless indirection during conntrack destruction + +From: Florian Westphal + +commit 6ae7989c9af0d98ab64196f4f4c6f6499454bd23 upstream. + +nf_ct_put() results in a usesless indirection: + +nf_ct_put -> nf_conntrack_put -> nf_conntrack_destroy -> rcu readlock + +indirect call of ct_hooks->destroy(). + +There are two _put helpers: +nf_ct_put and nf_conntrack_put. The latter is what should be used in +code that MUST NOT cause a linker dependency on the conntrack module +(e.g. calls from core network stack). + +Everyone else should call nf_ct_put() instead. + +A followup patch will convert a few nf_conntrack_put() calls to +nf_ct_put(), in particular from modules that already have a conntrack +dependency such as act_ct or even nf_conntrack itself. + +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/netfilter/nf_conntrack_common.h | 2 ++ + include/net/netfilter/nf_conntrack.h | 8 ++++++-- + net/netfilter/nf_conntrack_core.c | 12 ++++++------ + 3 files changed, 14 insertions(+), 8 deletions(-) + +--- a/include/linux/netfilter/nf_conntrack_common.h ++++ b/include/linux/netfilter/nf_conntrack_common.h +@@ -29,6 +29,8 @@ struct nf_conntrack { + }; + + void nf_conntrack_destroy(struct nf_conntrack *nfct); ++ ++/* like nf_ct_put, but without module dependency on nf_conntrack */ + static inline void nf_conntrack_put(struct nf_conntrack *nfct) + { + if (nfct && atomic_dec_and_test(&nfct->use)) +--- a/include/net/netfilter/nf_conntrack.h ++++ b/include/net/netfilter/nf_conntrack.h +@@ -76,6 +76,8 @@ struct nf_conn { + * Hint, SKB address this struct and refcnt via skb->_nfct and + * helpers nf_conntrack_get() and nf_conntrack_put(). + * Helper nf_ct_put() equals nf_conntrack_put() by dec refcnt, ++ * except that the latter uses internal indirection and does not ++ * result in a conntrack module dependency. + * beware nf_ct_get() is different and don't inc refcnt. + */ + struct nf_conntrack ct_general; +@@ -169,11 +171,13 @@ nf_ct_get(const struct sk_buff *skb, enu + return (struct nf_conn *)(nfct & NFCT_PTRMASK); + } + ++void nf_ct_destroy(struct nf_conntrack *nfct); ++ + /* decrement reference count on a conntrack */ + static inline void nf_ct_put(struct nf_conn *ct) + { +- WARN_ON(!ct); +- nf_conntrack_put(&ct->ct_general); ++ if (ct && refcount_dec_and_test(&ct->ct_general.use)) ++ nf_ct_destroy(&ct->ct_general); + } + + /* Protocol module loading */ +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -571,7 +571,7 @@ static void nf_ct_del_from_dying_or_unco + + #define NFCT_ALIGN(len) (((len) + NFCT_INFOMASK) & ~NFCT_INFOMASK) + +-/* Released via destroy_conntrack() */ ++/* Released via nf_ct_destroy() */ + struct nf_conn *nf_ct_tmpl_alloc(struct net *net, + const struct nf_conntrack_zone *zone, + gfp_t flags) +@@ -625,12 +625,11 @@ static void destroy_gre_conntrack(struct + #endif + } + +-static void +-destroy_conntrack(struct nf_conntrack *nfct) ++void nf_ct_destroy(struct nf_conntrack *nfct) + { + struct nf_conn *ct = (struct nf_conn *)nfct; + +- pr_debug("destroy_conntrack(%p)\n", ct); ++ pr_debug("%s(%p)\n", __func__, ct); + WARN_ON(atomic_read(&nfct->use) != 0); + + if (unlikely(nf_ct_is_template(ct))) { +@@ -656,9 +655,10 @@ destroy_conntrack(struct nf_conntrack *n + if (ct->master) + nf_ct_put(ct->master); + +- pr_debug("destroy_conntrack: returning ct=%p to slab\n", ct); ++ pr_debug("%s: returning ct=%p to slab\n", __func__, ct); + nf_conntrack_free(ct); + } ++EXPORT_SYMBOL(nf_ct_destroy); + + static void nf_ct_delete_from_lists(struct nf_conn *ct) + { +@@ -2825,7 +2825,7 @@ err_cachep: + + static struct nf_ct_hook nf_conntrack_hook = { + .update = nf_conntrack_update, +- .destroy = destroy_conntrack, ++ .destroy = nf_ct_destroy, + .get_tuple_skb = nf_conntrack_get_tuple_skb, + }; + diff --git a/queue-5.15/series b/queue-5.15/series index fa0e7b55232..25814941f14 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -108,3 +108,4 @@ kvm-x86-pmu-update-amd-pmc-sample-period-to-fix-guest-nmi-watchdog.patch kvm-x86-pend-kvm_req_apicv_update-during-vcpu-creation-to-fix-a-race.patch kvm-nvmx-defer-apicv-updates-while-l2-is-active-until-l1-is-active.patch kvm-svm-flush-when-freeing-encrypted-pages-even-on-sme_coherent-cpus.patch +netfilter-conntrack-avoid-useless-indirection-during-conntrack-destruction.patch