Hi Pablo, Please apply the next patch to your nf tree, which fixes a race condition: * Due to the insufficiently protected set pointers, there's a race between a fast swap/destroy and a slow kernel side add/del/test element operation in ipset. The attached patch fixes it by extending the the rcu_read_lock() protected areas and forcing ip_set_swap() to wait for the rcu_read_unlock() markers. v2: synchronize_rcu() is moved into ip_set_swap() in order not to burden ip_set_destroy() unnecessarily when all sets are destroyed. Thanks! Jozsef The following changes since commit 7153a404fb70d21097af3169354e1e5fda3fbb02: Merge tag 'nf-23-09-06' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf (2023-09-07 11:47:15 +0200) are available in the Git repository at: git://blackhole.kfki.hu/nf 682a101165d8b640577ed for you to fetch changes up to 682a101165d8b640577ede10ca2a803250e48ba8: netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test, v2 (2023-11-04 10:58:49 +0100) ---------------------------------------------------------------- Jozsef Kadlecsik (1): netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test, v2 net/netfilter/ipset/ip_set_core.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-)
