[PATCH 0/1] ipset patch to fix race condition between swap/destroy and add/del/test

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Pablo,

Please apply the next patch to your nf tree, which fixes a race condition:

* Due to the insufficiently protected set pointers, there's a race between a fast
  swap/destroy and a slow kernel side add/del/test element operation in ipset.
  The attached patch fixes it by extending the the rcu_read_lock() protected areas and
  forcing destroy() to wait for the rcu_read_unlock() markers.

Thanks!
Jozsef

The following changes since commit 7153a404fb70d21097af3169354e1e5fda3fbb02:

  Merge tag 'nf-23-09-06' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf (2023-09-07 11:47:15 +0200)

are available in the Git repository at:

  git://blackhole.kfki.hu/nf c063bd2737f588

for you to fetch changes up to c063bd2737f588859bc5f1455be9df6544e98ff2:

  netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (2023-10-19 21:06:09 +0200)

----------------------------------------------------------------
Jozsef Kadlecsik (1):
      netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test

 net/netfilter/ipset/ip_set_core.c | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)



[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux