@@ -83,6 +83,8 @@ struct nf_flowtable {
struct flow_block flow_block;
struct rw_semaphore flow_block_lock; /* Guards flow_block */
possible_net_t net;
+
+ struct rcu_work rwork;
};
static inline bool nf_flowtable_hw_offload(struct nf_flowtable *flowtable)
@@ -599,11 +599,11 @@ void nf_flow_table_cleanup(struct net_device *dev)
}
EXPORT_SYMBOL_GPL(nf_flow_table_cleanup);
-void nf_flow_table_free(struct nf_flowtable *flow_table)
+static void nf_flow_table_free_rwork(struct work_struct *work)
{
- mutex_lock(&flowtable_lock);
- list_del(&flow_table->list);
- mutex_unlock(&flowtable_lock);
+ struct nf_flowtable *flow_table;
+
+ flow_table = container_of(to_rcu_work(work), struct nf_flowtable, rwork);
cancel_delayed_work_sync(&flow_table->gc_work);
nf_flow_table_offload_flush(flow_table);
@@ -615,6 +615,16 @@ void nf_flow_table_free(struct nf_flowtable *flow_table)
module_put(flow_table->type->owner);
kfree(flow_table);
}
+
+void nf_flow_table_free(struct nf_flowtable *flow_table)
+{
+ mutex_lock(&flowtable_lock);
+ list_del(&flow_table->list);
+ mutex_unlock(&flowtable_lock);
+
+ INIT_RCU_WORK(&flow_table->rwork, nf_flow_table_free_rwork);
+ queue_rcu_work(system_power_efficient_wq, &flow_table->rwork);
+}
EXPORT_SYMBOL_GPL(nf_flow_table_free);
static int nf_flow_table_init_net(struct net *net)
At this time the frontends (tc, nftables) ensure that the nf_flowtable is removed after the frontend hooks are gone (tc action, netfilter hooks). In both cases the nf_flowtable can be safely free'd as no packets will be traversing these hooks anymore. However, the upcoming nf_flowtable kfunc for XDP will still have a pointer to the nf_flowtable in its own net_device -> nf_flowtable mapping. This mapping is removed via the flow_block UNBIND callback. This callback however comes after an rcu grace period, not before. Therefore defer the real freeing via call_rcu so that no kfunc can possibly be using the nf_flowtable (or flow entries within) anymore. Signed-off-by: Florian Westphal <fw@strlen.de> --- include/net/netfilter/nf_flow_table.h | 2 ++ net/netfilter/nf_flow_table_core.c | 18 ++++++++++++++---- 2 files changed, 16 insertions(+), 4 deletions(-)