9bfd50e6dc
Use AlmaLinux OS secure boot cert
Enable Btrfs support for all kernel variants
af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361}
hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024
qla4xxx: bring back deprecated PCI ids
be2iscsi: bring back deprecated PCI ids
kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained
gve: update QPL page registration logic to honor max_registered_pages (backport from upstream)
gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream)
52 lines
2.3 KiB
Diff
52 lines
2.3 KiB
Diff
From f5e3847dafb8aae3a40977b9a266e8c31cf0e018 Mon Sep 17 00:00:00 2001
|
|
From: Florian Westphal <fwestpha@redhat.com>
|
|
Date: Wed, 13 May 2026 17:22:21 +0200
|
|
Subject: [PATCH] netfilter: nf_tables: join hook list via splice_list_rcu() in
|
|
commit phase
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-168848
|
|
Upstream Status: commit a6134e62dba2
|
|
|
|
commit a6134e62dba2ea4f760b29d5226907f447c92400
|
|
Author: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Date: Wed Apr 15 17:56:14 2026 +0200
|
|
|
|
netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase
|
|
|
|
Publish new hooks in the list into the basechain/flowtable using
|
|
splice_list_rcu() to ensure netlink dump list traversal via rcu is safe
|
|
while concurrent ruleset update is going on.
|
|
|
|
Fixes: 78d9f48f7f44 ("netfilter: nf_tables: add devices to existing flowtable")
|
|
Fixes: b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain")
|
|
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
Signed-off-by: Florian Westphal <fwestpha@redhat.com>
|
|
|
|
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
|
|
index f67b9b0..32155f1 100644
|
|
--- a/net/netfilter/nf_tables_api.c
|
|
+++ b/net/netfilter/nf_tables_api.c
|
|
@@ -11048,8 +11048,8 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
|
|
nft_chain_commit_update(nft_trans_container_chain(trans));
|
|
nf_tables_chain_notify(&ctx, NFT_MSG_NEWCHAIN,
|
|
&nft_trans_chain_hooks(trans));
|
|
- list_splice(&nft_trans_chain_hooks(trans),
|
|
- &nft_trans_basechain(trans)->hook_list);
|
|
+ list_splice_rcu(&nft_trans_chain_hooks(trans),
|
|
+ &nft_trans_basechain(trans)->hook_list);
|
|
/* trans destroyed after rcu grace period */
|
|
} else {
|
|
nft_chain_commit_drop_policy(nft_trans_container_chain(trans));
|
|
@@ -11178,8 +11178,8 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
|
|
nft_trans_flowtable(trans),
|
|
&nft_trans_flowtable_hooks(trans),
|
|
NFT_MSG_NEWFLOWTABLE);
|
|
- list_splice(&nft_trans_flowtable_hooks(trans),
|
|
- &nft_trans_flowtable(trans)->hook_list);
|
|
+ list_splice_rcu(&nft_trans_flowtable_hooks(trans),
|
|
+ &nft_trans_flowtable(trans)->hook_list);
|
|
} else {
|
|
nft_clear(net, nft_trans_flowtable(trans));
|
|
nf_tables_flowtable_notify(&ctx,
|