diff options
| author | Florian Westphal <fw@strlen.de> | 2021-03-25 18:25:12 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2021-03-31 22:34:11 +0200 |
| commit | cefa31a9d46112c0706c218ea549bccf298a0068 (patch) | |
| tree | 8a9fdcb23a6d93fd5c10305e525dcb7ed1e964e9 /net/netfilter/nf_log.c | |
| parent | a38b5b56d6f4678a04c3c1943000953593391bf6 (diff) | |
| download | linux-cefa31a9d46112c0706c218ea549bccf298a0068.tar.bz2 | |
netfilter: nft_log: perform module load from nf_tables
modprobe calls from the nf_logger_find_get() API causes deadlock in very
special cases because they occur with the nf_tables transaction mutex held.
In the specific case of nf_log, deadlock is via:
A nf_tables -> transaction mutex -> nft_log -> modprobe -> nf_log_syslog \
-> pernet_ops rwsem -> wait for C
B netlink event -> rtnl_mutex -> nf_tables transaction mutex -> wait for A
C close() -> ip6mr_sk_done -> rtnl_mutex -> wait for B
Earlier patch added NFLOG/xt_LOG module softdeps to avoid the need to load
the backend module during a transaction.
For nft_log we would have to add a softdep for both nfnetlink_log or
nf_log_syslog, since we do not know in advance which of the two backends
are going to be configured.
This defers the modprobe op until after the transaction mutex is released.
Tested-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nf_log.c')
| -rw-r--r-- | net/netfilter/nf_log.c | 3 |
1 files changed, 0 insertions, 3 deletions
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c index eaa8181f5ef7..edee7fa944c1 100644 --- a/net/netfilter/nf_log.c +++ b/net/netfilter/nf_log.c @@ -170,9 +170,6 @@ int nf_logger_find_get(int pf, enum nf_log_type type) return 0; } - if (rcu_access_pointer(loggers[pf][type]) == NULL) - request_module("nf-logger-%u-%u", pf, type); - rcu_read_lock(); logger = rcu_dereference(loggers[pf][type]); if (logger == NULL) |