Skip to content
  • Florian Westphal's avatar
    cefa31a9
    netfilter: nft_log: perform module load from nf_tables · cefa31a9
    Florian Westphal authored
    
    
    modprobe calls from the nf_logger_find_get() API causes deadlock in very
    special cases because they occur with the nf_tables transaction mutex held.
    
    In the specific case of nf_log, deadlock is via:
    
     A nf_tables -> transaction mutex -> nft_log -> modprobe -> nf_log_syslog \
    	    -> pernet_ops rwsem -> wait for C
     B netlink event -> rtnl_mutex -> nf_tables transaction mutex -> wait for A
     C close() -> ip6mr_sk_done -> rtnl_mutex -> wait for B
    
    Earlier patch added NFLOG/xt_LOG module softdeps to avoid the need to load
    the backend module during a transaction.
    
    For nft_log we would have to add a softdep for both nfnetlink_log or
    nf_log_syslog, since we do not know in advance which of the two backends
    are going to be configured.
    
    This defers the modprobe op until after the transaction mutex is released.
    
    Tested-by: default avatarPhil Sutter <phil@nwl.cc>
    Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
    cefa31a9
    netfilter: nft_log: perform module load from nf_tables
    Florian Westphal authored
    
    
    modprobe calls from the nf_logger_find_get() API causes deadlock in very
    special cases because they occur with the nf_tables transaction mutex held.
    
    In the specific case of nf_log, deadlock is via:
    
     A nf_tables -> transaction mutex -> nft_log -> modprobe -> nf_log_syslog \
    	    -> pernet_ops rwsem -> wait for C
     B netlink event -> rtnl_mutex -> nf_tables transaction mutex -> wait for A
     C close() -> ip6mr_sk_done -> rtnl_mutex -> wait for B
    
    Earlier patch added NFLOG/xt_LOG module softdeps to avoid the need to load
    the backend module during a transaction.
    
    For nft_log we would have to add a softdep for both nfnetlink_log or
    nf_log_syslog, since we do not know in advance which of the two backends
    are going to be configured.
    
    This defers the modprobe op until after the transaction mutex is released.
    
    Tested-by: default avatarPhil Sutter <phil@nwl.cc>
    Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
    Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Loading