netfilter: nf_tables: fix false-positive lockdep splat
authorFlorian Westphal <fw@strlen.de>
Tue, 8 Aug 2023 18:40:17 +0000 (20:40 +0200)
committerFlorian Westphal <fw@strlen.de>
Tue, 15 Aug 2023 22:05:14 +0000 (00:05 +0200)
commitb9f052dc68f69dac89fe1e24693354c033daa091
treed3e3ae153f5057194ef409db697977b8a2e156a8
parente4dd0d3a2f64b8bd8029ec70f52bdbebd0644408
netfilter: nf_tables: fix false-positive lockdep splat

->abort invocation may cause splat on debug kernels:

WARNING: suspicious RCU usage
net/netfilter/nft_set_pipapo.c:1697 suspicious rcu_dereference_check() usage!
[..]
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by nft/133554: [..] (nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid
[..]
 lockdep_rcu_suspicious+0x1ad/0x260
 nft_pipapo_abort+0x145/0x180
 __nf_tables_abort+0x5359/0x63d0
 nf_tables_abort+0x24/0x40
 nfnetlink_rcv+0x1a0a/0x22c0
 netlink_unicast+0x73c/0x900
 netlink_sendmsg+0x7f0/0xc20
 ____sys_sendmsg+0x48d/0x760

Transaction mutex is held, so parallel updates are not possible.
Switch to _protected and check mutex is held for lockdep enabled builds.

Fixes: 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol")
Signed-off-by: Florian Westphal <fw@strlen.de>
net/netfilter/nft_set_pipapo.c