Re: [PATCH nf-next 3/7] netfilter: nft_table_offload: Add rtnl for chain and rule operations

[Pablo Neira Ayuso]

On Tue, Jul 23, 2019 at 08:52:40PM +0800, we...@ucloud.cn wrote:
> From: wenxu <we...@ucloud.cn>
> 
> The nft_setup_cb_call and ndo_setup_tc callback should be under rtnl lock
> 
> or it will report:
> kernel: RTNL: assertion failed at
> drivers/net/ethernet/mellanox/mlx5/core/en_rep.c (635)
> 
> Signed-off-by: wenxu <we...@ucloud.cn>
> ---
>  net/netfilter/nf_tables_offload.c | 16 ++++++++++++----
>  1 file changed, 12 insertions(+), 4 deletions(-)
> 
> diff --git a/net/netfilter/nf_tables_offload.c 
> b/net/netfilter/nf_tables_offload.c
> index 33543f5..3e1a1a8 100644
> --- a/net/netfilter/nf_tables_offload.c
> +++ b/net/netfilter/nf_tables_offload.c
> @@ -115,14 +115,18 @@ static int nft_setup_cb_call(struct nft_base_chain 
> *basechain,
>                            enum tc_setup_type type, void *type_data)
>  {
>       struct flow_block_cb *block_cb;
> -     int err;
> +     int err = 0;
>  
> +     rtnl_lock();

Please, have a look at 90d2723c6d4cb2ace50fc3b932a2bcc77710450b and
review if this assumption is correct. Probably nfnl_lock() is missing
from __nft_release_basechain().

I'd like to avoid grabbing the rtnl_lock().