From nobody Wed Dec 17 00:17:01 2025 Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 371FC3358B9 for ; Mon, 15 Dec 2025 15:33:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765812800; cv=none; b=hkQVhaoIkqdRJjeauJ9OY3hYVbI9UhffLXehJRCIZTfczX+oOKCKn7c5yo4Lq7lmISFVagpRJ00ucNI9cQ8n6cBqR9fU8+E2vZgHvl4YPMCSK2QSAN1lCpivGPxT5CpV2AbvMsGzU9emuiYVCmIMXOSEtWGNJj/gYgN5MtvWYPY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765812800; c=relaxed/simple; bh=WmWvQHLY73kq6pyu0tqKKzeIaeIlwBviwDjoR+oDJmg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=c3vqwcdU0MKw4VUpT2rhb3HV+KmW35k1UVJNDaQ+dEQdmbshh7YYvIiRJu4OC8m2D4PdqFHQ7WUnxUKrBS6YpfJFVlqfCp5yfufX1rJ+L2ryGoIW9lcicw6jT4bkkOaz+dEoMF9fUwrdAeLtUd8HGFP/3zMsAQ7HeHP15VYfNWU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kSM/ZAy9; arc=none smtp.client-ip=209.85.128.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kSM/ZAy9" Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-4779cb0a33fso43956035e9.0 for ; Mon, 15 Dec 2025 07:33:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1765812794; x=1766417594; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=shGL9qFpkDmIajBigNqT+nCnomY+2wBP3NtQMg+px3M=; b=kSM/ZAy9A/ibb/vYxkZYagoRF9ZMiff93LFSyEpNV6Io6o47xro300HFC3HSKrzA8e rg6CUwlaetlOnHfab2oAhHD1/BiLyApEIyAVD/VuFdOUvcPRwxkiLYIe/6LeFpYLiIqN +dKPOUAT6RXXRRLgSneQQkTE/vXdJBt+0cfeXXKHY91fkUhlObGHHapwyQfMGyvw8Fps JghF+yd7RH+F0SFJbPBPFG8/FRCskPXXMYKmmxT5QmI3BmNnItgb8eooKjx/51QU2msh uBFORfpYSld0a1V9P/eVcrX04ZSychNdwtYRoeOk67cpKLE2Arbanu9K669oPaCsq4Ab Gxww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765812794; x=1766417594; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=shGL9qFpkDmIajBigNqT+nCnomY+2wBP3NtQMg+px3M=; b=MgkdNhneUYTE1ceNyG90QXsX8uruo1NYGD+8Ea6I1n+V+1GzXFFvR5g9M8JXH+SHqs jMhc96qOXPYK5GllpOriLMyognEI50sn4nDDh5pG/yWdyy2y9cN1lSSp38Pb+jP4Cdna 03GkH/EEIvHk8u+jKwfM0Fd0cli0JBuDyZa4mpJ7VJBtcNrzSowbd/K6NCej6WOy1LDX FhKe6IXrGs9si4NHbs56Ht0pg7cOYkkF3hZKtsAeLY8YmxNveRg0tyjN9iMb13NKBuI+ tZQDJhhuqnr7H7S8GTIZDHapMMGeQ3uePOtCqukDi795xhzehdSCIvi3pyHRf38yKt1w Lfpw== X-Forwarded-Encrypted: i=1; AJvYcCXaExnTAsnOemwK+Y1isD8voRHWHDGq7XMfD/+045eHQKr5dFqoijRfgZMDpSKCUG0wt6PXmsL3GwIAc0c=@vger.kernel.org X-Gm-Message-State: AOJu0Yy+mI5GO1M27uxFc00J1Jn2JuNl5wcc1cScERVUtzk3vIvjCWuL tU5eYVSrr67iYB7kUaGmTICKs8rjsSdplWeyPMgKi33/xK30sJ664+iT X-Gm-Gg: AY/fxX7oPfbxznSQls8XOL4WaUfdQAutU8XkT7yjlRAZQ9RklMjveNGyeAgsalcg/gO EyhONYcBvU/8xt12oo+CYgFWMypC52yd39sNjUhjoQUaIy517zOiNvGdZC0RD6+wnGDUzIoEtUf UZEHzmlEVvb43V+N3gcZtyE3lfB/iy7Exm4Li30flZZLXKVQ6iDzkKB2MkYzTzvsX3BOwyXWvgV Xk0V5O98o7Zqe/0tiz9ginKSHLd1OIhydMhCUmhEm1binUunFaRHLseR5X/rLaRb0+o9WlxvNj6 iSDa44PtZwojeguS3bhrQZxpiKz+p1Bg5ztAjKqZPlflVZZdYlPvqGKY9ehH09tpAUE+b8txfFV snr9R4vp38adrQHM5uYLhtlPeKReVdxxfhDy21mQTigjxGNPNWlq6s0k28r3RbXM+6ydmAw9Ydf bQO8WSwTtLA+gPRYvFq775dNYr5/OJnHOJ4O52ON+2f+ixUwIdl0Ewzi5ov8TrMv4= X-Google-Smtp-Source: AGHT+IHKWs48xUNePoBMrBpBe8hDtPaLfvOFnL9ImcikdGgFf5GE4aphSLQpZ1+Kfb40qsOChnhBGA== X-Received: by 2002:a05:600c:4e90:b0:477:557b:691d with SMTP id 5b1f17b1804b1-47a942cd40dmr90250005e9.25.1765812793917; Mon, 15 Dec 2025 07:33:13 -0800 (PST) Received: from t14.labs.westermo.se (static-193-12-47-89.cust.tele2.se. [193.12.47.89]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-47a8f4ef38bsm203433985e9.0.2025.12.15.07.33.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 15 Dec 2025 07:33:13 -0800 (PST) From: Anders Grahn X-Google-Original-From: Anders Grahn To: Pablo Neira Ayuso , Jozsef Kadlecsik , Florian Westphal , Phil Sutter , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Sebastian Andrzej Siewior Cc: Anders Grahn , linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org Subject: [PATCH v2] netfilter: nft_counter: Fix reset of counters on 32bit archs Date: Mon, 15 Dec 2025 16:32:52 +0100 Message-ID: <20251215153253.957951-1-anders.grahn@westermo.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" nft_counter_reset() calls u64_stats_add() with a negative value to reset the counter. This will work on 64bit archs, hence the negative value added will wrap as a 64bit value which then can wrap the stat counter as well. On 32bit archs, the added negative value will wrap as a 32bit value and _not_ wrapping the stat counter properly. In most cases, this would just lead to a very large 32bit value being added to the stat counter. Fix by introducing u64_stats_sub(). Fixes: 4a1d3acd6ea8 ("netfilter: nft_counter: Use u64_stats_t for statistic= .") Signed-off-by: Anders Grahn --- include/linux/u64_stats_sync.h | 10 ++++++++++ net/netfilter/nft_counter.c | 4 ++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/include/linux/u64_stats_sync.h b/include/linux/u64_stats_sync.h index 457879938fc1..3366090a86bd 100644 --- a/include/linux/u64_stats_sync.h +++ b/include/linux/u64_stats_sync.h @@ -89,6 +89,11 @@ static inline void u64_stats_add(u64_stats_t *p, unsigne= d long val) local64_add(val, &p->v); } =20 +static inline void u64_stats_sub(u64_stats_t *p, s64 val) +{ + local64_sub(val, &p->v); +} + static inline void u64_stats_inc(u64_stats_t *p) { local64_inc(&p->v); @@ -130,6 +135,11 @@ static inline void u64_stats_add(u64_stats_t *p, unsig= ned long val) p->v +=3D val; } =20 +static inline void u64_stats_sub(u64_stats_t *p, s64 val) +{ + p->v -=3D val; +} + static inline void u64_stats_inc(u64_stats_t *p) { p->v++; diff --git a/net/netfilter/nft_counter.c b/net/netfilter/nft_counter.c index cc7325329496..0d70325280cc 100644 --- a/net/netfilter/nft_counter.c +++ b/net/netfilter/nft_counter.c @@ -117,8 +117,8 @@ static void nft_counter_reset(struct nft_counter_percpu= _priv *priv, nft_sync =3D this_cpu_ptr(&nft_counter_sync); =20 u64_stats_update_begin(nft_sync); - u64_stats_add(&this_cpu->packets, -total->packets); - u64_stats_add(&this_cpu->bytes, -total->bytes); + u64_stats_sub(&this_cpu->packets, total->packets); + u64_stats_sub(&this_cpu->bytes, total->bytes); u64_stats_update_end(nft_sync); =20 local_bh_enable(); --=20 2.43.0