netfilter: nf_tables: avoid softlockup warnings in nft_chain_validate

Florian Westphal · Florian Westphal · commit 7e7a817f2dfd · 2025-12-15T15:04:04.000+01:00
This reverts commit 314c828 ("netfilter: nf_tables: can't schedule in nft_chain_validate"): Since commit a60a5ab ("netfilter: nf_tables: allow iter callbacks to sleep") the iterator callback is invoked without rcu read lock held, so this cond_resched() is now valid. Signed-off-by: Florian Westphal <fw@strlen.de>
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
@@ -4171,6 +4171,8 @@ int nft_chain_validate(const struct nft_ctx *ctx, struct nft_chain *chain)
 			if (err < 0)
 				return err;
 		}
+
+		cond_resched();
 	}
 
 	nft_chain_vstate_update(ctx, chain);
@@ -4195,8 +4197,6 @@ static int nft_table_validate(struct net *net, const struct nft_table *table)
 		err = nft_chain_validate(&ctx, chain);
 		if (err < 0)
 			goto err;
-
-		cond_resched();
 	}
 
 err:

Original file line number	Diff line number	Diff line change
`@@ -4171,6 +4171,8 @@ int nft_chain_validate(const struct nft_ctx ctx, struct nft_chain chain)`
`4171`	`4171`	`if (err < 0)`
`4172`	`4172`	`return err;`
`4173`	`4173`	`}`
	`4174`	`+`
	`4175`	`+ cond_resched();`
`4174`	`4176`	`}`
`4175`	`4177`
`4176`	`4178`	`nft_chain_vstate_update(ctx, chain);`
`@@ -4195,8 +4197,6 @@ static int nft_table_validate(struct net net, const struct nft_table table)`
`4195`	`4197`	`err = nft_chain_validate(&ctx, chain);`
`4196`	`4198`	`if (err < 0)`
`4197`	`4199`	`goto err;`
`4198`		`-`
`4199`		`- cond_resched();`
`4200`	`4200`	`}`
`4201`	`4201`
`4202`	`4202`	`err:`