netfilter: nf_tables: annotate data-races around element expiration

element expiration can be read-write locklessly, it can be written by
dynset and read from netlink dump, add annotation.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index c302b396e1a7ecfba81001790154d9515af8c465..1528af3fe26f3ff50797c536d8012e6c74b0b9a1 100644 (file)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -835,7 +835,7 @@ static inline bool __nft_set_elem_expired(const struct nft_set_ext *ext,
                                          u64 tstamp)
 {
        return nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION) &&
-              time_after_eq64(tstamp, *nft_set_ext_expiration(ext));
+              time_after_eq64(tstamp, READ_ONCE(*nft_set_ext_expiration(ext)));
 }
 
 static inline bool nft_set_elem_expired(const struct nft_set_ext *ext)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 571aa30918e9bb5fb1357a2c73066ea14637faa7..77dce3d61ae6ac5b9867617ac50094ee78da8c03 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5827,7 +5827,7 @@ static int nf_tables_fill_setelem(struct sk_buff *skb,
        if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
                u64 expires, now = get_jiffies_64();
 
-               expires = *nft_set_ext_expiration(ext);
+               expires = READ_ONCE(*nft_set_ext_expiration(ext));
                if (time_before64(now, expires))
                        expires -= now;
                else

diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 5812fd880b791d00a58434948323b3de3dc4755f..ca4b52e68295a419652ac640ec491557d446559b 100644 (file)
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -96,7 +96,7 @@ void nft_dynset_eval(const struct nft_expr *expr,
                if (priv->op == NFT_DYNSET_OP_UPDATE &&
                    nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
                        timeout = priv->timeout ? : READ_ONCE(set->timeout);
-                       *nft_set_ext_expiration(ext) = get_jiffies_64() + timeout;
+                       WRITE_ONCE(*nft_set_ext_expiration(ext), get_jiffies_64() + timeout);
                }
 
                nft_set_elem_update_expr(ext, regs, pkt);