netfilter: nf_tables: can't schedule in nft_chain_validate

BugLink: https://bugs.launchpad.net/bugs/2037005

[ Upstream commit 314c828 ]

Can be called via nft set element list iteration, which may acquire
rcu and/or bh read lock (depends on set type).

BUG: sleeping function called from invalid context at net/netfilter/nf_tables_api.c:3353
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1232, name: nft
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
2 locks held by nft/1232:
 #0: ffff8881180e3ea8 (&nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid
 #1: ffffffff83f5f540 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire
Call Trace:
 nft_chain_validate
 nft_lookup_validate_setelem
 nft_pipapo_walk
 nft_lookup_validate
 nft_chain_validate
 nft_immediate_validate
 nft_chain_validate
 nf_tables_validate
 nf_tables_abort

No choice but to move it to nf_tables_validate().

Fixes: 81ea010 ("netfilter: nf_tables: add rescheduling points during loop detection walks")
Signed-off-by: Florian Westphal <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
Signed-off-by: Kamal Mostafa <[email protected]>
Signed-off-by: Roxana Nicolescu <[email protected]>

net/netfilter/nf_tables_api.c

@@ -3561,8 +3561,6 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
  if (err < 0)
  return err;
  }
-
- cond_resched();
  }
 
  return 0;
@@ -3586,6 +3584,8 @@ static int nft_table_validate(struct net *net, const struct nft_table *table)
  err = nft_chain_validate(&ctx, chain);
  if (err < 0)
  return err;
+
+ cond_resched();
  }
 
  return 0;