This is a note to let you know that I've just added the patch titled
netfilter: nf_tables: revert do not remove elements if set backend implements .abort
to the 6.5-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nf_tables-revert-do-not-remove-elements-if-set-backend-implements-.abort.patch
and it can be found in the queue-6.5 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From f86fb94011aeb3b26337fc22204ca726aeb8bc24 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date: Wed, 18 Oct 2023 13:18:39 +0200
Subject: netfilter: nf_tables: revert do not remove elements if set backend implements .abort
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
commit f86fb94011aeb3b26337fc22204ca726aeb8bc24 upstream.
nf_tables_abort_release() path calls nft_set_elem_destroy() for
NFT_MSG_NEWSETELEM which releases the element, however, a reference to
the element still remains in the working copy.
Fixes: ebd032fa8818 ("netfilter: nf_tables: do not remove elements if set backend implements .abort")
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/netfilter/nf_tables_api.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -10336,10 +10336,7 @@ static int __nf_tables_abort(struct net
break;
}
te = (struct nft_trans_elem *)trans->data;
- if (!te->set->ops->abort ||
- nft_setelem_is_catchall(te->set, &te->elem))
- nft_setelem_remove(net, te->set, &te->elem);
-
+ nft_setelem_remove(net, te->set, &te->elem);
if (!nft_setelem_is_catchall(te->set, &te->elem))
atomic_dec(&te->set->nelems);
Patches currently in stable-queue which might be from pablo@xxxxxxxxxxxxx are
queue-6.5/netfilter-nf_tables-revert-do-not-remove-elements-if-set-backend-implements-.abort.patch
queue-6.5/netfilter-nft_set_rbtree-.deactivate-fails-if-element-has-expired.patch
queue-6.5/netfilter-nf_tables-do-not-refresh-timeout-when-resetting-element.patch
queue-6.5/netfilter-nf_tables-do-not-remove-elements-if-set-backend-implements-.abort.patch
