netfilter: x_tables: Use correct memory barriers.
PATCH 1/1 netfilter: x_tables: Use correct memory barriers.
From: Mark Tomlinson <[email protected]>
commit 175e476b8cdf2a4de7432583b49c871345e4f8a1 upstream.
When a new table value was assigned, it was followed by a write memory barrier. This ensured that all writes before this point would complete before any writes after this point. However, to determine whether the rules are unused, the sequence counter is read. To ensure that all writes have been done before these reads, a full memory barrier is needed, not just a write memory barrier. The same argument applies when incrementing the counter, before the rules are read.
Changing to using smp_mb() instead of smp_wmb() fixes the kernel panic reported in cc00bcaa5899 (which is still present), while still maintaining the same speed of replacing tables.
The smb_mb() barriers potentially slow the packet path, however testing has shown no measurable change in performance on a 4-core MIPS64 platform.
--- include/linux/netfilter/x_tables.h | 2 +- net/netfilter/x_tables.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-)
include/linux/netfilter/x_tables.h +1 -1
@@ -327,7 +327,7 @@ static inline unsigned int xt_write_recseq_begin(void)* since addend is most likely 1 */ __this_cpu_add (xt_recseq.sequence, addend); -smp_wmb (); +smp_mb ();return addend; }
net/netfilter/x_tables.c +3 -0
@@ -1146,6 +1146,9 @@ xt_replace_table(struct xt_table *table,smp_wmb (); table->private = newinfo; +/* make sure all cpus see new ->private value */ +smp_mb (); +/* * Even though table entries have now been swapped, other CPU's * may still be using the old entries. This is okay, because
Signature · 6 lines
2.11.0 -- DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Quoted 26 lines · Pavel Machek
From: Mark Tomlinson <[email protected]>
commit
175e476b8cdf2a4de7432583b49c871345e4f8a1upstream.When a new table value was assigned, it was followed by a write memory barrier. This ensured that all writes before this point would complete before any writes after this point. However, to determine whether the rules are unused, the sequence counter is read. To ensure that all writes have been done before these reads, a full memory barrier is needed, not just a write memory barrier. The same argument applies when incrementing the counter, before the rules are read.
Changing to using
smp_mb()instead ofsmp_wmb()fixes the kernel panic reported incc00bcaa5899(which is still present), while still maintaining the same speed of replacing tables.The
smb_mb()barriers potentially slow the packet path, however testing has shown no measurable change in performance on a 4-core MIPS64 platform.Fixes 7f5c6d4f665b ("netfilter: get rid of atomic ops in fast path")Signed-off-by Mark Tomlinson <[email protected]>Signed-off-by Pablo Neira Ayuso <[email protected]>[Ported to stable, affected barrier is added by d3d40f237480abf3268956daf18cdc56edd32834 in mainline]Signed-off-by Pavel Machek (CIP) <[email protected]>
Quoted 4 lines
--- include/linux/netfilter/x_tables.h | 2 +- net/netfilter/x_tables.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-)
What about 4.14 and 4.9? I can't take patches only for 4.4 that are not also in newer releases.
thanks,
greg k-h
Hi,
Quoted 32 lines · Greg KH
Quoted 26 lines · Pavel Machek
From: Mark Tomlinson <[email protected]>
commit
175e476b8cdf2a4de7432583b49c871345e4f8a1upstream.When a new table value was assigned, it was followed by a write memory barrier. This ensured that all writes before this point would complete before any writes after this point. However, to determine whether the rules are unused, the sequence counter is read. To ensure that all writes have been done before these reads, a full memory barrier is needed, not just a write memory barrier. The same argument applies when incrementing the counter, before the rules are read.
Changing to using
smp_mb()instead ofsmp_wmb()fixes the kernel panic reported incc00bcaa5899(which is still present), while still maintaining the same speed of replacing tables.The
smb_mb()barriers potentially slow the packet path, however testing has shown no measurable change in performance on a 4-core MIPS64 platform.Fixes 7f5c6d4f665b ("netfilter: get rid of atomic ops in fast path")Signed-off-by Mark Tomlinson <[email protected]>Signed-off-by Pablo Neira Ayuso <[email protected]>[Ported to stable, affected barrier is added by d3d40f237480abf3268956daf18cdc56edd32834 in mainline]Signed-off-by Pavel Machek (CIP) <[email protected]>Quoted 4 lines
--- include/linux/netfilter/x_tables.h | 2 +- net/netfilter/x_tables.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-)
Quoted 2 lines
What about 4.14 and 4.9? I can't take patches only for 4.4 that are not also in newer releases.
I have confirmed that this patch can be applied to 4.9 and 4.14. Do I need resend this patch again?
Quoted 5 lines
thanks,
greg k-h
Best regards,
Nobuhiro