This is a note to let you know that I've just added the patch titled
netfilter: nf_tables: check if catch-all set element is active in next generation
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
netfilter-nf_tables-check-if-catch-all-set-element-is-active-in-next-generation.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Date: Fri, 12 Jan 2024 23:28:45 +0100
Subject: netfilter: nf_tables: check if catch-all set element is active in next generation
From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7 upstream.
When deactivating the catch-all set element, check the state in the next
generation that represents this transaction.
This bug uncovered after the recent removal of the element busy mark
a2dd0233cbc4 ("netfilter: nf_tables: remove busy mark and gc batch API").
Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support")
Cc: stable@xxxxxxxxxxxxxxx
Reported-by: lonial con <kongln9170@xxxxxxxxx>
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/netfilter/nf_tables_api.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6034,7 +6034,7 @@ static int nft_setelem_catchall_deactiva
list_for_each_entry(catchall, &set->catchall_list, list) {
ext = nft_set_elem_ext(set, catchall->elem);
- if (!nft_is_active(net, ext))
+ if (!nft_is_active_next(net, ext))
continue;
kfree(elem->priv);
Patches currently in stable-queue which might be from pablo@xxxxxxxxxxxxx are
queue-5.15/netfilter-nf_tables-check-if-catch-all-set-element-is-active-in-next-generation.patch
queue-5.15/netfilter-nf_tables-mark-newset-as-dead-on-transacti.patch
