iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: use get_random_u32 instead of prandom

Browse Source 
bh might occur while updating per-cpu rnd_state from user context,
ie. local_out path.

BUG: using smp_processor_id() in preemptible [00000000] code: nginx/2725
caller is nft_ng_random_eval+0x24/0x54 [nft_numgen]
Call Trace:
 check_preemption_disabled+0xde/0xe0
 nft_ng_random_eval+0x24/0x54 [nft_numgen]

Use the random driver instead, this also avoids need for local prandom
state. Moreover, prandom now uses the random driver since d4150779e6
("random32: use real rng for non-deterministic randomness").

Based on earlier patch from Pablo Neira.

Fixes: 6b2faee0ca ("netfilter: nft_meta: place prandom handling in a helper")
Fixes: 978d8f9055 ("netfilter: nft_numgen: add map lookups for numgen random operations")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Florian Westphal 2022-05-18 20:15:31 +02:00 committed by Pablo Neira Ayuso
parent f5826c8c9d
commit b1fd94e704
2 changed files with 5 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
net/netfilter/nft_meta.c
View File

@ -14,6 +14,7 @@
#include <linux/in.h> #include <linux/in.h>
#include <linux/ip.h> #include <linux/ip.h>
#include <linux/ipv6.h> #include <linux/ipv6.h>
#include <linux/random.h>
#include <linux/smp.h> #include <linux/smp.h>
#include <linux/static_key.h> #include <linux/static_key.h>
#include <net/dst.h> #include <net/dst.h>
@ -32,8 +33,6 @@
#define NFT_META_SECS_PER_DAY 86400 #define NFT_META_SECS_PER_DAY 86400
#define NFT_META_DAYS_PER_WEEK 7 #define NFT_META_DAYS_PER_WEEK 7
static DEFINE_PER_CPU(struct rnd_state, nft_prandom_state);
static u8 nft_meta_weekday(void) static u8 nft_meta_weekday(void)
{ {
time64_t secs = ktime_get_real_seconds(); time64_t secs = ktime_get_real_seconds();
@ -271,13 +270,6 @@ static bool nft_meta_get_eval_ifname(enum nft_meta_keys key, u32 *dest,
return true; return true;
} }
static noinline u32 nft_prandom_u32(void)
{
struct rnd_state *state = this_cpu_ptr(&nft_prandom_state);
return prandom_u32_state(state);
}
#ifdef CONFIG_IP_ROUTE_CLASSID #ifdef CONFIG_IP_ROUTE_CLASSID
static noinline bool static noinline bool
nft_meta_get_eval_rtclassid(const struct sk_buff *skb, u32 *dest) nft_meta_get_eval_rtclassid(const struct sk_buff *skb, u32 *dest)
@ -389,7 +381,7 @@ void nft_meta_get_eval(const struct nft_expr *expr,
break; break;
#endif #endif
case NFT_META_PRANDOM: case NFT_META_PRANDOM:
*dest = nft_prandom_u32(); *dest = get_random_u32();
break; break;
#ifdef CONFIG_XFRM #ifdef CONFIG_XFRM
case NFT_META_SECPATH: case NFT_META_SECPATH:
@ -518,7 +510,6 @@ int nft_meta_get_init(const struct nft_ctx *ctx,
len = IFNAMSIZ; len = IFNAMSIZ;
break; break;
case NFT_META_PRANDOM: case NFT_META_PRANDOM:
prandom_init_once(&nft_prandom_state);
len = sizeof(u32); len = sizeof(u32);
break; break;
#ifdef CONFIG_XFRM #ifdef CONFIG_XFRM

12
net/netfilter/nft_numgen.c
View File

@ -9,12 +9,11 @@
#include <linux/netlink.h> #include <linux/netlink.h>
#include <linux/netfilter.h> #include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h> #include <linux/netfilter/nf_tables.h>
#include <linux/random.h>
#include <linux/static_key.h> #include <linux/static_key.h>
#include <net/netfilter/nf_tables.h> #include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables_core.h> #include <net/netfilter/nf_tables_core.h>
static DEFINE_PER_CPU(struct rnd_state, nft_numgen_prandom_state);
struct nft_ng_inc { struct nft_ng_inc {
u8 dreg; u8 dreg;
u32 modulus; u32 modulus;
@ -135,12 +134,9 @@ struct nft_ng_random {
u32 offset; u32 offset;
}; };
static u32 nft_ng_random_gen(struct nft_ng_random *priv) static u32 nft_ng_random_gen(const struct nft_ng_random *priv)
{ {
struct rnd_state *state = this_cpu_ptr(&nft_numgen_prandom_state); return reciprocal_scale(get_random_u32(), priv->modulus) + priv->offset;
return reciprocal_scale(prandom_u32_state(state), priv->modulus) +
priv->offset;
} }
static void nft_ng_random_eval(const struct nft_expr *expr, static void nft_ng_random_eval(const struct nft_expr *expr,
@ -168,8 +164,6 @@ static int nft_ng_random_init(const struct nft_ctx *ctx,
if (priv->offset + priv->modulus - 1 < priv->offset) if (priv->offset + priv->modulus - 1 < priv->offset)
return -EOVERFLOW; return -EOVERFLOW;
prandom_init_once(&nft_numgen_prandom_state);
return nft_parse_register_store(ctx, tb[NFTA_NG_DREG], &priv->dreg, return nft_parse_register_store(ctx, tb[NFTA_NG_DREG], &priv->dreg,
NULL, NFT_DATA_VALUE, sizeof(u32)); NULL, NFT_DATA_VALUE, sizeof(u32));
} }