Commit 0bdc6da8 authored by Florian Westphal's avatar Florian Westphal Committed by Alexei Starovoitov
Browse files

netfilter: disallow bpf hook attachment at same priority 



This is just to avoid ordering issues between multiple bpf programs,
this could be removed later in case it turns out to be too cautious.

bpf prog could still be shared with non-bpf hook, otherwise we'd have to
make conntrack hook registration fail just because a bpf program has
same priority.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Link: https://lore.kernel.org/r/20230421170300.24115-5-fw@strlen.de


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 506a74db

net/netfilter/core.c

+12 −0
Original line number Diff line number Diff line
@@ -119,6 +119,18 @@ nf_hook_entries_grow(const struct nf_hook_entries *old, 
		for (i = 0; i < old_entries; i++) {

			if (orig_ops[i] != &dummy_ops)

				alloc_entries++;



			/* Restrict BPF hook type to force a unique priority, not

			 * shared at attach time.

			 *

			 * This is mainly to avoid ordering issues between two

			 * different bpf programs, this doesn't prevent a normal

			 * hook at same priority as a bpf one (we don't want to

			 * prevent defrag, conntrack, iptables etc from attaching).

			 */

			if (reg->priority == orig_ops[i]->priority &&

			    reg->hook_ops_type == NF_HOOK_OP_BPF)

				return ERR_PTR(-EBUSY);

		}

	}