From nobody Mon Sep 28 08:45:54 2026 Received: from mail-yx1-f44.google.com (mail-yx1-f44.google.com [74.125.224.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2914B412BF9 for ; Mon, 24 Aug 2026 11:58:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787572721; cv=none; b=gFhTszUPgnN/0odg2Hb7zROK1+cXxpV5Ht+o6P8R+7guPf6K2Th+EKG5AaAa7+5IAccs4awe3KJYt5EfCgvHMcSsJq1gZvw4SXOtIPUqgp5b/rJTK9AsU+zarXLbfHVbAh70R9QsTLcwzEa9dkag/yjlBbdfidUveGmlWdsGRMI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787572721; c=relaxed/simple; bh=rwVtocl8QFG6AaUZrwl4HjX8gTEbKaqLxkOKeOAb5m8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=atxseeLrM9OOxGbZgYE4lGBsw81GWg8d3zPeTHiEvkUwOgAldWOxn1xXRBfTuUbcZkoJ+eAiCNFXhYKhaWaH4a0BY+cEj81v4JvxieunngzG86FEDTzPRiiDIGAx7Mpe6fUzRTs7LJdGxUWiBmZjCKo6YWnzw77NTnlUJbZfg9Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=HzWBr09R; arc=none smtp.client-ip=74.125.224.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HzWBr09R" Received: by mail-yx1-f44.google.com with SMTP id 956f58d0204a3-66787b93a0aso404574d50.3 for ; Mon, 24 Aug 2026 04:58:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787572718; x=1788177518; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=ZFQ1cWzuhWOIEwwaSmn6Rpdvmfaw4ozucDVtslq1L8Y=; b=HzWBr09RCmRoq/bxVeP0Zjgbh2DBU0ABmNOoF89ZPshp5wpA5jaoBwhbl1coqfEZ02 DeE1TG0nEb4D7UPdQkLshtbTUW8j5okRBCh2TI0Mrh8vq1t+0oXae7jAtz2UYySsbv4c ZQjQ92MveJ6g5H89V0kCjv9enEgPby/mLGiZ64o88RW1lB8st9+5BSdevT1qGQjt6vaf SzMxa8QlADtCPdB6NRlv1I7N0wFylvYBAOiLQuOvq7acGCs8EjrIk9qxCxPMMmDzx9u7 4jbCAIAPbBjZvBFrc7aoCe/s4AXG5PRiVR/w6eTopY60SVudyhZThuaQBm3gLWAjNev+ ub1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787572718; x=1788177518; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ZFQ1cWzuhWOIEwwaSmn6Rpdvmfaw4ozucDVtslq1L8Y=; b=r8NujsrsM/6+ryDAo0FLKfDuWZK404sRwLhZP4i2CrA++LUe5WETpyHGaSjFUkjb+B t/+MxHjZgyyEJkO9BMEL8kyQhCeC2ZI2V5L1+L6Tmkl1Puk2O+wi1vYtFJnTz/oqNLbb YPWaSbVLNwY8M/RRl8FIsNdTprqy8AMggIH6poh8fxlxzYceoA0S5nw/ZBkY0jTnB8+l Z4WGavTOWbX22K+s5Mf9SI3G4B/1Btiqw6+HxiBBNwKf2voxN7yv7y6LoGfBPJeayoLl MBnCWFXW9PPUyyFBiBtO8UzfugEEEq+50jgbmgL72kn7p3W8kJm1qHYj8JVjqukSBCBn WUaw== X-Forwarded-Encrypted: i=1; AHgh+Ror6yN9eog4pN3UHsccFcZHpQTCtS8n0+7eYcF7GVRxnT5liRazPb1vFmYPwrt9ZYockQSjmoO0DvRbh1E=@vger.kernel.org X-Gm-Message-State: AFuF++mmXM2N0gjBhL7aIkyHUqVJcsYYOuaY4u8mnhN38CModo3j0wzW KRqp5S2FyPJlq1DED/8hGX3JGFm13Hf8MVAKywTcrsqT7veE67sNSV+u X-Gm-Gg: AR+sD13nAwFO6/cXSRjQH6mcuaGTcpys52vypOOJjLQU92evCLe+OsP/7nNuEiNoVxT cMOMAJVB3ikPlBrQ6AqVXk2jqGENirheDwTwhapigWBov+H5YmnoJftLfND9VmiXpKBY9culuCt ang8bkyxtqoNvbmI6tjGhgi7nxPgu/WP0+SHgXWf26jXn+fcqDXZQKlOAp97chJwye0tYQiPqTM 9h3Uqx8W99WU5VO5fpPCNYlGyeg28TsDmLMKIF8ZYjnsmsYGLqb2cRplkdvW/ZIF7HvimeEGCJL 7vwu0xdTz5IVTwjSiy6hNYe3CBUwscVPc/cHcicGKmNLEC/9nOzuX3uKrfmUFXWdOwvyU2sDjXz FvJkNVHsHPU1DG4a22EyNoxWdSrzDI3PljHT0NOma2zZHq6bz+Vu8tNA9gIHG48tpVl+Qi+pr0r c/w8U8Kug2PE6LA+JgH15OhrzhArReGyEu4ZVls2ocH0difJp5Je46n39cU9XzV//0t/nzaUXNn F36rDnq+LqMETvpJRKpRZ1+sAwg5OO2+xu5XYkUIc8w8ih7GSTOzYUgkwasmvuFHg== X-Received: by 2002:a53:acc1:0:20b0:668:430b:a928 with SMTP id 956f58d0204a3-66ce48b6cdfmr6454864d50.0.1787572717705; Mon, 24 Aug 2026 04:58:37 -0700 (PDT) Received: from localhost.localdomain (45.78.65.84.16clouds.com. [45.78.65.84]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-66cf4a0c6c3sm3474127d50.12.2026.08.24.04.58.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 24 Aug 2026 04:58:37 -0700 (PDT) From: Chengfeng Ye To: Pablo Neira Ayuso , Florian Westphal , Phil Sutter , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Paul Blakey Cc: netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Chengfeng Ye , stable@vger.kernel.org Subject: [PATCH] netfilter: flowtable: flush delete work after final GC Date: Mon, 24 Aug 2026 19:58:29 +0800 Message-ID: <20260824115829.205118-1-nicoyip.dev@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" nf_flow_table_offload_flush_cleanup() drains delete work before its final garbage-collection pass. That pass can itself queue more delete work. During teardown, one possible interleaving is: teardown worker delete worker first GC: work allocation fails leave flow retryable drain delete workqueue final GC: allocation succeeds queue FLOW_CLS_DESTROY work destroy rhashtable free flowtable read flowtable->net nf_flow_table_offload_flush_cleanup() flushes only the delete work that was queued before the final GC. NF_FLOW_HW_DYING is set only after successful work allocation, so a GFP_ATOMIC allocation failure during the first GC leaves the entry eligible for retry. If that retry later succeeds in the final GC, it queues new destroy work after the earlier flush, and that work can retain a stale flowtable pointer past the free. This was reproducible with failslab forcing the initial GFP_ATOMIC allocation failure, and KASAN reported: BUG: KASAN: slab-use-after-free in flow_offload_work_handler+0xbe8/0xe30 Read of size 8 at addr ffff888109c9fd98 by task kworker/u16:3/397 Workqueue: nf_ft_offload_del flow_offload_work_handler Call Trace: print_report+0xd0/0x630 kasan_report+0xce/0x100 flow_offload_work_handler+0xbe8/0xe30 process_one_work+0x63a/0x1070 worker_thread+0x45b/0xd10 kthread+0x2c6/0x3b0 ret_from_fork+0x36e/0x5a0 Allocated by task 87: nf_tables_newflowtable+0x5d0/0x22f0 nfnetlink_rcv_batch+0x1396/0x1d00 netlink_unicast+0x5f5/0x860 netlink_sendmsg+0x70a/0xba0 Freed by task 11: kfree+0x131/0x3c0 nf_tables_trans_destroy_work+0xb26/0xeb0 process_one_work+0x63a/0x1070 worker_thread+0x45b/0xd10 Last potentially related work creation: __queue_work+0x68e/0x1030 flow_offload_del+0x74c/0xad0 nf_flow_offload_gc_step+0x264/0x8e0 nf_flow_table_gc_run+0xcd/0x150 nf_flow_table_offload_flush_cleanup+0x5c/0x70 nf_flow_table_free+0x280/0x350 nf_tables_flowtable_destroy+0x71/0x270 Flush the delete workqueue again after the final GC. This keeps every successfully queued destroy operation within the flowtable lifetime. Fixes: c921ffe85333 ("netfilter: flowtable: Fix flushing of offloaded flows= on free") Cc: stable@vger.kernel.org Signed-off-by: Chengfeng Ye --- net/netfilter/nf_flow_table_offload.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_= table_offload.c index 801a3dd9ceea..0fd09554b9ce 100644 --- a/net/netfilter/nf_flow_table_offload.c +++ b/net/netfilter/nf_flow_table_offload.c @@ -1167,6 +1167,7 @@ void nf_flow_table_offload_flush_cleanup(struct nf_fl= owtable *flowtable) if (nf_flowtable_hw_offload(flowtable)) { flush_workqueue(nf_flow_offload_del_wq); nf_flow_table_gc_run(flowtable); + flush_workqueue(nf_flow_offload_del_wq); } } =20 --=20 2.43.0