diff options
author | Florian Westphal <fw@strlen.de> | 2021-09-17 18:50:17 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-09-21 03:46:56 +0200 |
commit | b53deef054e58fe4f37c66211b8ece9f8fc1aa13 (patch) | |
tree | 33dccb30a9fb4b7ffdef1a6cb4cc2f56194447c2 /net/netfilter/xt_osf.c | |
parent | cc8072153aafd65bff1b3679a112cb6ba71ab375 (diff) | |
download | linux-b53deef054e58fe4f37c66211b8ece9f8fc1aa13.tar.gz linux-b53deef054e58fe4f37c66211b8ece9f8fc1aa13.tar.bz2 linux-b53deef054e58fe4f37c66211b8ece9f8fc1aa13.zip |
netfilter: log: work around missing softdep backend module
iptables/nftables has two types of log modules:
1. backend, e.g. nf_log_syslog, which implement the functionality
2. frontend, e.g. xt_LOG or nft_log, which call the functionality
provided by backend based on nf_tables or xtables rule set.
Problem is that the request_module() call to load the backed in
nf_logger_find_get() might happen with nftables transaction mutex held
in case the call path is via nf_tables/nft_compat.
This can cause deadlocks (see 'Fixes' tags for details).
The chosen solution as to let modprobe deal with this by adding 'pre: '
soft dep tag to xt_LOG (to load the syslog backend) and xt_NFLOG (to
load nflog backend).
Eric reports that this breaks on systems with older modprobe that
doesn't support softdeps.
Another, similar issue occurs when someone either insmods xt_(NF)LOG
directly or unloads the backend module (possible if no log frontend
is in use): because the frontend module is already loaded, modprobe is
not invoked again so the softdep isn't evaluated.
Add a workaround: If nf_logger_find_get() returns -ENOENT and call
is not via nft_compat, load the backend explicitly and try again.
Else, let nft_compat ask for deferred request_module via nf_tables
infra.
Softdeps are kept in-place, so with newer modprobe the dependencies
are resolved from userspace.
Fixes: cefa31a9d461 ("netfilter: nft_log: perform module load from nf_tables")
Fixes: a38b5b56d6f4 ("netfilter: nf_log: add module softdeps")
Reported-and-tested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/xt_osf.c')
0 files changed, 0 insertions, 0 deletions