Hi Pablo, Please apply the next patch to your nf tree, which fixes a race condition: * Due to the insufficiently protected set pointers, there's a race between a fast swap/destroy and a slow kernel side add/del/test element operation in ipset. The attached patch fixes it by extending the the rcu_read_lock() protected areas and forcing destroy() to wait for the rcu_read_unlock() markers. Thanks! Jozsef The following changes since commit 7153a404fb70d21097af3169354e1e5fda3fbb02: Merge tag 'nf-23-09-06' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf (2023-09-07 11:47:15 +0200) are available in the Git repository at: git://blackhole.kfki.hu/nf c063bd2737f588 for you to fetch changes up to c063bd2737f588859bc5f1455be9df6544e98ff2: netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (2023-10-19 21:06:09 +0200) ---------------------------------------------------------------- Jozsef Kadlecsik (1): netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test net/netfilter/ipset/ip_set_core.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-)
