From nobody Wed Dec 17 04:04:34 2025 Received: from mail-wr1-f44.google.com (mail-wr1-f44.google.com [209.85.221.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CAE60288C3D for ; Mon, 15 Dec 2025 12:14:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765800886; cv=none; b=jWOYIrGi2DMcoPaK7Al+2j0GhsOuVlVd2N0xMwTFZsRXWKe660t9V0rJWMVtQRwE7OspUgqqoF897XBKzZqxuMbhABieocCK37wWpCpZ5X1YJaj7Eago+2Ns914KmbRIE1zB6Djplk5K8NPRbIoJz0vIbEYg9Xr+tQgyLFqkKuA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765800886; c=relaxed/simple; bh=qzev6H1XEFsSXgdNdXoA6uKXhB+qml6NnknlVg8Mgf0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Rx84bsKiSl25M55xi/tIUqZ1nI+5esydhdyMvQozknbfA2yAyjMb/mh8tGOD4nLw9nHnQ5eUARnN2u7ehR+c0oE48/TId3Uq5DGxDrJuSFdhLnuprCHxhBsNaStIPXzFUXlck286l3QYxVCDwBHHUCfgpLO8Jq4KKQLtUys39fo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=PZIH88CQ; arc=none smtp.client-ip=209.85.221.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="PZIH88CQ" Received: by mail-wr1-f44.google.com with SMTP id ffacd0b85a97d-430f5ecaa08so675170f8f.3 for ; Mon, 15 Dec 2025 04:14:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1765800883; x=1766405683; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=QUzh3HRON4HuLqM3J/BiPzn56jwNwHP4ZMm17mHr9BY=; b=PZIH88CQS92Wf95/bTpIClI29Ut+0XPRy7iyclp+6bt4dPMZTI6OHcrqwF4mffEfms TmBSactjr3ixUpWpav6BDyZGxfnAgChmwcoTcvney9yW+JJBOxebeFD+bz2Qqcdq+tXj wNB9/SFXkHHwUj4ODsy8NgGeD32yOP8heYHmH9Vi793MDEvSURH/kYEwldkwWnrddl3s MDF/vYQGfpluZPrJF+YzsIUI625hxu5rlooA0+PrgqSm8AAzS7nwYyvnb+3xEXWTmItq yYUe0VzhWsdfhO9wg8wCaNL+oczHYAah1wICNJFNZvYrc0HNuiFboi6iqK1Mnrha8l/C mD3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765800883; x=1766405683; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=QUzh3HRON4HuLqM3J/BiPzn56jwNwHP4ZMm17mHr9BY=; b=GD5uU3U3KGZKn4l8CnH2FOTctITqSqoO6z1UnmBIv2gAPBE0ts1cLPWgYWu4d0hW4w DGCPzUUo9aVNca+Xu4JXrj6x28mxCORujlhgSe+M3uw5YkAxvW47aUd3Sy9DCMrmvi7c q2aufvIIc6pBG0s6tvg8ns4LV+SxITzmt+ntzhiRNikcPWwgYWAhuJjZG1QzUICJ4lSV NEAdpUXjSDmleIlKVZHloEVOlVqtdvBavn1ZALGyGS9akoff6O6GGEkSeEKvv2SM6YPv IhUDsOt9uQpAF5OVsK4ue5vowoIzB1gmB81JypeAYfaVcURlhRKUlxY1jtr6IyzHyKY8 frgw== X-Forwarded-Encrypted: i=1; AJvYcCWwqduepb045/grJ7vv73yXzOHBcBU6izSq/d6QmPKMcVL61oCVYXc5dfdaiCwYcu4D7vFJV9a0Su+VWS8=@vger.kernel.org X-Gm-Message-State: AOJu0Yy84+V1Xv9IAx8oO78UaeHojVK1uWqkhA8YA2ojzBxCv9iuXSH4 sPJBeegwZboMSrn6DBoHXx8kfZ2eICDe9je2uU+kxShzv2LgnWoxlLgm X-Gm-Gg: AY/fxX72jj43KwIa2nEuaJruHeNJwUlERmhlwKBxnC2AsFKKYx/hjOGQ/x41MsniBsY Jh4j2/2LlEqOlf8H9FzJQNUrYAjy35hTdcRHEe8F6pMnVg4ZrmNNyIE7in4HtdT0bZ1qgcA2oXX 44N7q1D/UMGtgB0L8WGnQVneNgO3iEB4fZK5nFZgjGvSYzuuUP6PqFqhofAkuinKh1ctfFLL7kK /3o0m6XRw/8C/cHDBZe6jvgI5Ozd9PF1haUpdceUBi+F9zv1dGeTZ+kjWXAQjf7L0zXB4h/vF8e ne9swaYVXQEUgoYB9KNFqdeyvtxe0RIx84uwKrRdApPOGcX60dAjLs1323TfCiWWhA3NpEI2Y/n xEpEyLZvAq/Ab2VJAeaEJp6LA7l8Ar6GWFzHySZS6JUPqYzrAEiiCUzEOFPXGdWME2nXX97KmQD l04tlyaYsOTbFD2AxPmq15i9X76KQeM6L4pfNAZa2/Oik93DhI8UT7A0zvpiX+g+A= X-Google-Smtp-Source: AGHT+IFkFI5Fed5WJZaom+Q22BnP7VYpBn2pZsMhlwsCKTPIWco3rZqhSM6jBupF7mLLbA3zdSm3Nw== X-Received: by 2002:a05:6000:1acb:b0:42b:3e20:f1b0 with SMTP id ffacd0b85a97d-42fb44a39e3mr8300705f8f.7.1765800882550; Mon, 15 Dec 2025 04:14:42 -0800 (PST) Received: from t14.labs.westermo.se (static-193-12-47-89.cust.tele2.se. [193.12.47.89]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-430f42a3290sm13465847f8f.17.2025.12.15.04.14.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 15 Dec 2025 04:14:42 -0800 (PST) From: Anders Grahn X-Google-Original-From: Anders Grahn To: Pablo Neira Ayuso , Jozsef Kadlecsik , Florian Westphal , Phil Sutter , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Sebastian Andrzej Siewior Cc: Anders Grahn , linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org Subject: [PATCH] netfilter: nft_counter: Fix reset of counters on 32bit archs Date: Mon, 15 Dec 2025 13:12:57 +0100 Message-ID: <20251215121258.843823-1-anders.grahn@westermo.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" nft_counter_reset() calls u64_stats_add() with a negative value to reset the counter. This will work on 64bit archs, hence the negative value added will wrap as a 64bit value which then can wrap the stat counter as well. On 32bit archs, the added negative value will wrap as a 32bit value and _not_ wrapping the stat counter properly. In most cases, this would just lead to a very large 32bit value being added to the stat counter. Fix by introducing u64_stats_sub(). Fixes: 4a1d3acd6ea8 ("netfilter: nft_counter: Use u64_stats_t for statistic= ") Signed-off-by: Anders Grahn --- include/linux/u64_stats_sync.h | 10 ++++++++++ net/netfilter/nft_counter.c | 4 ++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/include/linux/u64_stats_sync.h b/include/linux/u64_stats_sync.h index 457879938fc1..9942d29b17e5 100644 --- a/include/linux/u64_stats_sync.h +++ b/include/linux/u64_stats_sync.h @@ -89,6 +89,11 @@ static inline void u64_stats_add(u64_stats_t *p, unsigne= d long val) local64_add(val, &p->v); } =20 +static inline void u64_stats_sub(u64_stats_t *p, unsigned long val) +{ + local64_sub(val, &p->v); +} + static inline void u64_stats_inc(u64_stats_t *p) { local64_inc(&p->v); @@ -130,6 +135,11 @@ static inline void u64_stats_add(u64_stats_t *p, unsig= ned long val) p->v +=3D val; } =20 +static inline void u64_stats_sub(u64_stats_t *p, unsigned long val) +{ + p->v -=3D val; +} + static inline void u64_stats_inc(u64_stats_t *p) { p->v++; diff --git a/net/netfilter/nft_counter.c b/net/netfilter/nft_counter.c index cc7325329496..0d70325280cc 100644 --- a/net/netfilter/nft_counter.c +++ b/net/netfilter/nft_counter.c @@ -117,8 +117,8 @@ static void nft_counter_reset(struct nft_counter_percpu= _priv *priv, nft_sync =3D this_cpu_ptr(&nft_counter_sync); =20 u64_stats_update_begin(nft_sync); - u64_stats_add(&this_cpu->packets, -total->packets); - u64_stats_add(&this_cpu->bytes, -total->bytes); + u64_stats_sub(&this_cpu->packets, total->packets); + u64_stats_sub(&this_cpu->bytes, total->bytes); u64_stats_update_end(nft_sync); =20 local_bh_enable(); --=20 2.43.0