Received-SPF: pass (google.com: domain of linux-kernel+bounces-22040-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
From: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
To: "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>,
	Paolo Abeni <pabeni@redhat.com>,
	Florian Westphal <fw@strlen.de>
Cc: netdev@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	kernel@openvz.org,
	Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Subject: [PATCH 3/4] netfilter: propagate net to nf_bridge_get_physindev
Date: Wed, 10 Jan 2024 19:00:13 +0800
Message-ID: <20240110110451.5473-4-ptikhomirov@virtuozzo.com>
In-Reply-To: <20240110110451.5473-1-ptikhomirov@virtuozzo.com>
References: <20240110110451.5473-1-ptikhomirov@virtuozzo.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?C2Thc/jgWhBdAO8rTszOQMOa56aurQOvLLJsEYC+3+L5LkqmTJ1k6ys0vKZD?=
 =?us-ascii?Q?It243KrM37l4iHVT1ieDkcFwgRoe/lpkD2F4TFfClo2mWEVZpN4bdK6pl4Bs?=
 =?us-ascii?Q?efcGxFMLvwjkNWkdXaJsNVjiLUpcfvBQzTD82qoA5P1P2AJ+PGrhF0YVLvzk?=
 =?us-ascii?Q?9iZrevVTgVeZ+1541nGUbY1mw/dS28VS//va0DK7/yKXUmxDI3alCBd1QwH4?=
 =?us-ascii?Q?Fo85tN4EApAIG1lMb2b8sO3kwUJtN+26vSvfIdREyqVeMz4n3ttcYI9tPliF?=
 =?us-ascii?Q?i0EpxxwoxeMaS1PzcqmRjWNjwbDcPUXFqF/S4gldwnRnTV7ZNdhbfIlkBiQp?=
 =?us-ascii?Q?zNP0s6eOekwYqGHSTcyoDty42UuSatJl/GXAAYqTG8ZTRYkSAZU5GeuotOZy?=
 =?us-ascii?Q?MPeJm9OOmv5o4xdRVYi0aLMTAGw0NCLB+41vB4lvbodqD/Hz4dECkKMkBcwY?=
 =?us-ascii?Q?5fyX5LMRp00Av4FahBPE508rXqFKalC2c8mojmGAN8ylBThuLbbi5IMzjA3v?=
 =?us-ascii?Q?dnwSsXAEPMJHmzKtDyBDGqAF52DjyFxcsvLMODyOFARW9XlF40fMbIStGZbf?=
 =?us-ascii?Q?/aZ/ytXwBJhKgn6Vkc8MxRwiAjM0QWn3/MZD+3n8ozsSRTc8U/68GKzhWOmX?=
 =?us-ascii?Q?6tnAEYzvlePUd8XDcbiTd6BosXW+3S+85XRNmCmZd1+3nRh4bK9gnNaq7VOe?=
 =?us-ascii?Q?/9Y4zkDrfg57cb3DRQBPwoLwKBetnfkGSkWQwjoY7fo2xsGZ+git5pC/MPZE?=
 =?us-ascii?Q?ZdV8NHdefU5FquaJko50srB0gLp2F8Fq9a96+QTTWzNWMNO6A61jWAlTl3/8?=
 =?us-ascii?Q?sGqLw2AwgD3GuQbcgQ+Qz5Uoi3wIZHtY0FCpnDF8E2iAZLwbngY1Zsyh1VOW?=
 =?us-ascii?Q?vCXcxuDf21U+B8rL/pZtzxgVdtVwUKIMBIg0J+YZQAmin2wtH39xXzVdb7JK?=
 =?us-ascii?Q?ebTnz8UZigzfhbQ7EquHHjdCCbIplTh3rgeU0GTr3a9MEsKxUY3OZ/YHWRkr?=
 =?us-ascii?Q?i4HtfErMd6m1P1JjqjAhfPdKdoSspdkNTTJeFw8T6PG9DcHzfKtFVGFfJUSP?=
 =?us-ascii?Q?u/G4DtDA8wXKUZ8qeSG5zuHn43udfvYxjJZ824wEDaF+BJhW18w9sO4mOGUw?=
 =?us-ascii?Q?7w9iOFYgfQheY01yE6uLYy8xzdRqEXoRI247brWZsnZLr9zsAj8x1WPL+Kv7?=
 =?us-ascii?Q?z/PhHC0prTwfXBYlbPJ66ekvKbpESM1fl+npqA4a+hV992uWd6T4IHbFEXeV?=
 =?us-ascii?Q?ys7M+bCW4Bs+LomiZEpLBEIioj4PldETY/KtbRK7OJgyApniEZ35JXLPo7Xk?=
 =?us-ascii?Q?s+PkBQh/mlGUPMYXmAtx2qUdgaP/zvokMRS1zmHNgtRa0hpQI9lxsbFbCoG6?=
 =?us-ascii?Q?A0M0Td8eVLZCF3xB5UT9t/0SnL+ihpVR/K9H+qTjIx4bwe62dZexRSMYGLE2?=
 =?us-ascii?Q?dDp57APKf7QbE3T05tFpn76tMBw/kyxJVJAtpk1/ffvke5/fC0aVgO6eqIru?=
 =?us-ascii?Q?1vCe6hZWZRceKzo1jIX55MR0iChFs1QFEaArxXV8jgIHrAYD3g0/9pbHoqzt?=
 =?us-ascii?Q?98TQm+5DfVxt5BJK3YadB3TLoV6ywQbYTsk4mv9yxarFj9+RLMA/JpNiX9Gy?=
 =?us-ascii?Q?EnyHk4WmDuENCui+WsYI6reaq4th9IY/ay82lN+oLswdWQ2EKUt9rRcmOK5m?=
 =?us-ascii?Q?GPZ/Nw=3D=3D?=
X-OriginatorOrg: virtuozzo.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 29ebc161-e4d6-4e7e-1cb0-08dc11cc098c
X-MS-Exchange-CrossTenant-AuthSource: DU0PR08MB9003.eurprd08.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Jan 2024 11:05:21.3637
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 3ailSpB743b9yviqeuPlki9OHjculBU/G/oA60jFI7ErZlE6nJZq3UvQN1rREYC1RyWkwVTzrz8V756ukOUgQfj2V9nzv1EWfak2n5dgp3M=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR08MB5990

This is a preparation patch for replacing physindev with physinif on
nf_bridge_info structure. We will use dev_get_by_index_rcu to resolve
device, when needed, and it requires net.

Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
---
 include/linux/netfilter_bridge.h           |  2 +-
 net/ipv4/netfilter/nf_reject_ipv4.c        |  2 +-
 net/ipv6/netfilter/nf_reject_ipv6.c        |  2 +-
 net/netfilter/ipset/ip_set_hash_netiface.c |  8 ++++----
 net/netfilter/nf_log_syslog.c              | 13 +++++++------
 net/netfilter/nf_queue.c                   |  2 +-
 net/netfilter/nfnetlink_log.c              |  5 +++--
 net/netfilter/xt_physdev.c                 |  2 +-
 8 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h
index f980edfdd2783..e927b9a15a556 100644
--- a/include/linux/netfilter_bridge.h
+++ b/include/linux/netfilter_bridge.h
@@ -56,7 +56,7 @@ static inline int nf_bridge_get_physoutif(const struct sk_buff *skb)
 }
 
 static inline struct net_device *
-nf_bridge_get_physindev(const struct sk_buff *skb)
+nf_bridge_get_physindev(const struct sk_buff *skb, struct net *net)
 {
 	const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
 
diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index f01b038fc1cda..86e7d390671af 100644
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -289,7 +289,7 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb,
 	 * build the eth header using the original destination's MAC as the
 	 * source, and send the RST packet directly.
 	 */
-	br_indev = nf_bridge_get_physindev(oldskb);
+	br_indev = nf_bridge_get_physindev(oldskb, net);
 	if (br_indev) {
 		struct ethhdr *oeth = eth_hdr(oldskb);
 
diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index d45bc54b7ea55..27b2164f4c439 100644
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -354,7 +354,7 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,
 	 * build the eth header using the original destination's MAC as the
 	 * source, and send the RST packet directly.
 	 */
-	br_indev = nf_bridge_get_physindev(oldskb);
+	br_indev = nf_bridge_get_physindev(oldskb, net);
 	if (br_indev) {
 		struct ethhdr *oeth = eth_hdr(oldskb);
 
diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index 95aeb31c60e0d..30a655e5c4fdc 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -138,9 +138,9 @@ hash_netiface4_data_next(struct hash_netiface4_elem *next,
 #include "ip_set_hash_gen.h"
 
 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
-static const char *get_physindev_name(const struct sk_buff *skb)
+static const char *get_physindev_name(const struct sk_buff *skb, struct net *net)
 {
-	struct net_device *dev = nf_bridge_get_physindev(skb);
+	struct net_device *dev = nf_bridge_get_physindev(skb, net);
 
 	return dev ? dev->name : NULL;
 }
@@ -177,7 +177,7 @@ hash_netiface4_kadt(struct ip_set *set, const struct sk_buff *skb,
 
 	if (opt->cmdflags & IPSET_FLAG_PHYSDEV) {
 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
-		const char *eiface = SRCDIR ? get_physindev_name(skb) :
+		const char *eiface = SRCDIR ? get_physindev_name(skb, xt_net(par)) :
 					      get_physoutdev_name(skb);
 
 		if (!eiface)
@@ -395,7 +395,7 @@ hash_netiface6_kadt(struct ip_set *set, const struct sk_buff *skb,
 
 	if (opt->cmdflags & IPSET_FLAG_PHYSDEV) {
 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
-		const char *eiface = SRCDIR ? get_physindev_name(skb) :
+		const char *eiface = SRCDIR ? get_physindev_name(skb, xt_net(par)) :
 					      get_physoutdev_name(skb);
 
 		if (!eiface)
diff --git a/net/netfilter/nf_log_syslog.c b/net/netfilter/nf_log_syslog.c
index c66689ad2b491..58402226045e8 100644
--- a/net/netfilter/nf_log_syslog.c
+++ b/net/netfilter/nf_log_syslog.c
@@ -111,7 +111,8 @@ nf_log_dump_packet_common(struct nf_log_buf *m, u8 pf,
 			  unsigned int hooknum, const struct sk_buff *skb,
 			  const struct net_device *in,
 			  const struct net_device *out,
-			  const struct nf_loginfo *loginfo, const char *prefix)
+			  const struct nf_loginfo *loginfo, const char *prefix,
+			  struct net *net)
 {
 	const struct net_device *physoutdev __maybe_unused;
 	const struct net_device *physindev __maybe_unused;
@@ -121,7 +122,7 @@ nf_log_dump_packet_common(struct nf_log_buf *m, u8 pf,
 			in ? in->name : "",
 			out ? out->name : "");
 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
-	physindev = nf_bridge_get_physindev(skb);
+	physindev = nf_bridge_get_physindev(skb, net);
 	if (physindev && in != physindev)
 		nf_log_buf_add(m, "PHYSIN=%s ", physindev->name);
 	physoutdev = nf_bridge_get_physoutdev(skb);
@@ -148,7 +149,7 @@ static void nf_log_arp_packet(struct net *net, u_int8_t pf,
 		loginfo = &default_loginfo;
 
 	nf_log_dump_packet_common(m, pf, hooknum, skb, in, out, loginfo,
-				  prefix);
+				  prefix, net);
 	dump_arp_packet(m, loginfo, skb, skb_network_offset(skb));
 
 	nf_log_buf_close(m);
@@ -845,7 +846,7 @@ static void nf_log_ip_packet(struct net *net, u_int8_t pf,
 		loginfo = &default_loginfo;
 
 	nf_log_dump_packet_common(m, pf, hooknum, skb, in,
-				  out, loginfo, prefix);
+				  out, loginfo, prefix, net);
 
 	if (in)
 		dump_mac_header(m, loginfo, skb);
@@ -880,7 +881,7 @@ static void nf_log_ip6_packet(struct net *net, u_int8_t pf,
 		loginfo = &default_loginfo;
 
 	nf_log_dump_packet_common(m, pf, hooknum, skb, in, out,
-				  loginfo, prefix);
+				  loginfo, prefix, net);
 
 	if (in)
 		dump_mac_header(m, loginfo, skb);
@@ -916,7 +917,7 @@ static void nf_log_unknown_packet(struct net *net, u_int8_t pf,
 		loginfo = &default_loginfo;
 
 	nf_log_dump_packet_common(m, pf, hooknum, skb, in, out, loginfo,
-				  prefix);
+				  prefix, net);
 
 	dump_mac_header(m, loginfo, skb);
 
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 3dfcb3ac5cb44..e2f334f70281f 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -84,7 +84,7 @@ static void __nf_queue_entry_init_physdevs(struct nf_queue_entry *entry)
 	const struct sk_buff *skb = entry->skb;
 
 	if (nf_bridge_info_exists(skb)) {
-		entry->physin = nf_bridge_get_physindev(skb);
+		entry->physin = nf_bridge_get_physindev(skb, entry->state.net);
 		entry->physout = nf_bridge_get_physoutdev(skb);
 	} else {
 		entry->physin = NULL;
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 134e05d31061e..ad93dd77e6071 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -463,7 +463,8 @@ __build_packet_message(struct nfnl_log_net *log,
 			const struct net_device *outdev,
 			const char *prefix, unsigned int plen,
 			const struct nfnl_ct_hook *nfnl_ct,
-			struct nf_conn *ct, enum ip_conntrack_info ctinfo)
+			struct nf_conn *ct, enum ip_conntrack_info ctinfo,
+			struct net *net)
 {
 	struct nfulnl_msg_packet_hdr pmsg;
 	struct nlmsghdr *nlh;
@@ -804,7 +805,7 @@ nfulnl_log_packet(struct net *net,
 
 	__build_packet_message(log, inst, skb, data_len, pf,
 				hooknum, in, out, prefix, plen,
-				nfnl_ct, ct, ctinfo);
+				nfnl_ct, ct, ctinfo, net);
 
 	if (inst->qlen >= qthreshold)
 		__nfulnl_flush(inst);
diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index ec6ed6fda96c5..343e65f377d44 100644
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -59,7 +59,7 @@ physdev_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	    (!!outdev ^ !(info->invert & XT_PHYSDEV_OP_BRIDGED)))
 		return false;
 
-	physdev = nf_bridge_get_physindev(skb);
+	physdev = nf_bridge_get_physindev(skb, xt_net(par));
 	indev = physdev ? physdev->name : NULL;
 
 	if ((info->bitmask & XT_PHYSDEV_OP_ISIN &&
-- 
2.43.0