[Devel] [PATCH RH7] netfilter: drop/reaquire nfnl_lock on request_module() in nft_log module

[Andrey Ryabinin]

On 7/16/20 3:37 PM, Konstantin Khorenko wrote:
> +static int nf_logger_find_get_lock(int pf, enum nf_log_type type)
> +{
> +	struct nf_logger *logger;
> +	int ret = 0;
> +
> +	logger = loggers[pf][type];
> +	if (logger == NULL) {
> +		nfnl_unlock(NFNL_SUBSYS_NFTABLES);
> +		request_module("nf-logger-%u-%u", pf, type);
> +		nfnl_lock(NFNL_SUBSYS_NFTABLES);
> +		ret = -EAGAIN;

nfnetlink_rcv_batch() has special error path for EAGAIN:
			/* The lock was released to autoload some module, we
			 * have to abort and start from scratch using the
			 * original skb.
			 */
			if (err == -EAGAIN) {
				status |= NFNL_BATCH_REPLAY;
				goto done;
			}


Yet, nf_logger_find_get_lock() don't return immediately with EAGAIN, but continues and potentially replaces EAGAIN with ENOENT.
Why?

> +	}
> +
> +	rcu_read_lock();
> +	logger = rcu_dereference(loggers[pf][type]);
> +
> +	if ((logger == NULL) ||
> +	    ((ret == 0) && !try_module_get(logger->me))) {
> +		ret = -ENOENT;
> +	}
> +	rcu_read_unlock();
> +	return ret;
> +}
> +