netfilter: nf_tables: move hardware offload step after building the chain blob

[ Upstream commit b1881d362e1924b66f6016c3efd28807032b41bf ]

Allocate the chain blob before the ruleset offload to reduce chances of
entering an inconsistent state where the offloaded ruleset in the nic
and the software ruleset differ.

Fixes: c9626a2cbdb2 ("netfilter: nf_tables: add hardware offload support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index d01f96d32f2821b02dd484725d10a1b1f4fb2e4a..a3a66b6268cd6d43108a12432b59e44ca53d3d00 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -10774,10 +10774,6 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
                return -EAGAIN;
        }
 
-       err = nft_flow_rule_offload_commit(net);
-       if (err < 0)
-               return err;
-
        /* 1.  Allocate space for next generation rules_gen_X[] */
        list_for_each_entry_safe(trans, next, &nft_net->commit_list, list) {
                struct nft_table *table = trans->table;
@@ -10802,6 +10798,16 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)
                }
        }
 
+       /* must be last, so audit and chain blob set up does not leave hardware
+        * in consistent state.
+        */
+       err = nft_flow_rule_offload_commit(net);
+       if (err < 0) {
+               nf_tables_commit_chain_prepare_cancel(net);
+               nf_tables_commit_audit_free(&adl);
+               return err;
+       }
+
        /* step 2.  Make rules_gen_X visible to packet path */
        list_for_each_entry(table, &nft_net->tables, list) {
                list_for_each_entry(chain, &table->chains, list)