Re: [PATCH 1/1] netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type

[Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>]

Hi Jozsef,

On Tue, Jun 04, 2024 at 03:58:03PM +0200, Jozsef Kadlecsik wrote:
[...]
> @@ -424,14 +428,8 @@ static void
>  list_set_destroy(struct ip_set *set)
>  {
>  	struct list_set *map = set->data;
> -	struct set_elem *e, *n;
>  
> -	list_for_each_entry_safe(e, n, &map->members, list) {
> -		list_del(&e->list);
> -		ip_set_put_byindex(map->net, e->id);
> -		ip_set_ext_destroy(set, e);
> -		kfree(e);
> -	}
> +	BUG_ON(!list_empty(&map->members));

It would probably be better to turn this is WARN_ON_ONCE, such as:

        WARN_ON_ONCE(!list_empty(&map->members);

BUG_ON is only allowed to be used in very particular cases these days.

I can update this patch if you are fine with it.

>  	kfree(map);
>  
>  	set->data = NULL;
> -- 
> 2.39.2
>