netfilter: nf_tables_offload: add __nft_offload_get_chain function

Add __nft_offload_get_chain function to get basechain from device. This
function requires that caller holds the per-netns nftables mutex. This
patch implicitly fixes missing offload flags check and proper mutex from
nft_indr_block_cb().

Fixes: 9a32669fecfb ("netfilter: nf_tables_offload: support indr block call")
Signed-off-by: wenxu <wenxu@ucloud.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
index 239cb78..e200491 100644 (file)
--- a/net/netfilter/nf_tables_offload.c
+++ b/net/netfilter/nf_tables_offload.c
@@ -369,33 +369,49 @@ int nft_flow_rule_offload_commit(struct net *net)
        return err;
 }
 
-static void nft_indr_block_cb(struct net_device *dev,
-                             flow_indr_block_bind_cb_t *cb, void *cb_priv,
-                             enum flow_block_command command)
+static struct nft_chain *__nft_offload_get_chain(struct net_device *dev)
 {
+       struct nft_base_chain *basechain;
        struct net *net = dev_net(dev);
        const struct nft_table *table;
-       const struct nft_chain *chain;
+       struct nft_chain *chain;
 
-       list_for_each_entry_rcu(table, &net->nft.tables, list) {
+       list_for_each_entry(table, &net->nft.tables, list) {
                if (table->family != NFPROTO_NETDEV)
                        continue;
 
-               list_for_each_entry_rcu(chain, &table->chains, list) {
-                       if (nft_is_base_chain(chain)) {
-                               struct nft_base_chain *basechain;
-
-                               basechain = nft_base_chain(chain);
-                               if (!strncmp(basechain->dev_name, dev->name,
-                                            IFNAMSIZ)) {
-                                       nft_indr_block_ing_cmd(dev, basechain,
-                                                              cb, cb_priv,
-                                                              command);
-                                       return;
-                               }
-                       }
+               list_for_each_entry(chain, &table->chains, list) {
+                       if (!nft_is_base_chain(chain) ||
+                           !(chain->flags & NFT_CHAIN_HW_OFFLOAD))
+                               continue;
+
+                       basechain = nft_base_chain(chain);
+                       if (strncmp(basechain->dev_name, dev->name, IFNAMSIZ))
+                               continue;
+
+                       return chain;
                }
        }
+
+       return NULL;
+}
+
+static void nft_indr_block_cb(struct net_device *dev,
+                             flow_indr_block_bind_cb_t *cb, void *cb_priv,
+                             enum flow_block_command cmd)
+{
+       struct net *net = dev_net(dev);
+       struct nft_chain *chain;
+
+       mutex_lock(&net->nft.commit_mutex);
+       chain = __nft_offload_get_chain(dev);
+       if (chain) {
+               struct nft_base_chain *basechain;
+
+               basechain = nft_base_chain(chain);
+               nft_indr_block_ing_cmd(dev, basechain, cb, cb_priv, cmd);
+       }
+       mutex_unlock(&net->nft.commit_mutex);
 }
 
 static struct flow_indr_block_ing_entry block_ing_entry = {