Patch "netfilter: nf_tables: do not set up extensions for end interval" has been added to the 6.0-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    netfilter: nf_tables: do not set up extensions for end interval

to the 6.0-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     netfilter-nf_tables-do-not-set-up-extensions-for-end.patch
and it can be found in the queue-6.0 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b02d98151e07db34bdb39fcdc2ebba209377c634
Author: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date:   Mon Nov 14 11:31:54 2022 +0100

    netfilter: nf_tables: do not set up extensions for end interval
    
    [ Upstream commit 33c7aba0b4ffd6d7cdab862a034eb582a5120a38 ]
    
    Elements with an end interval flag set on do not store extensions. The
    global set definition is currently setting on the timeout and stateful
    expression for end interval elements.
    
    This leads to skipping end interval elements from the set->ops->walk()
    path as the expired check bogusly reports true.
    
    Moreover, do not set up stateful expressions for elements with end
    interval flag set on since this is never used.
    
    Fixes: 65038428b2c6 ("netfilter: nf_tables: allow to specify stateful expression in set definition")
    Fixes: 8d8540c4f5e0 ("netfilter: nft_set_rbtree: add timeout support")
    Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 42e370575c30..0a6f3c1e9ab7 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5958,7 +5958,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
 					    &timeout);
 		if (err)
 			return err;
-	} else if (set->flags & NFT_SET_TIMEOUT) {
+	} else if (set->flags & NFT_SET_TIMEOUT &&
+		   !(flags & NFT_SET_ELEM_INTERVAL_END)) {
 		timeout = set->timeout;
 	}
 
@@ -6024,7 +6025,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
 			err = -EOPNOTSUPP;
 			goto err_set_elem_expr;
 		}
-	} else if (set->num_exprs > 0) {
+	} else if (set->num_exprs > 0 &&
+		   !(flags & NFT_SET_ELEM_INTERVAL_END)) {
 		err = nft_set_elem_expr_clone(ctx, set, expr_array);
 		if (err < 0)
 			goto err_set_elem_expr_clone;