From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
commit 60c0c230c6f046da536d3df8b39a20b9a9fd6af0 upstream.
rbtree lazy gc on insert might collect an end interval element that has
been just added in this transactions, skip end interval elements that
are not yet active.
Fixes: f718863aca46 ("netfilter: nft_set_rbtree: fix overlap expiration walk")
Cc: stable@xxxxxxxxxxxxxxx
Reported-by: lonial con <kongln9170@xxxxxxxxx>
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/netfilter/nft_set_rbtree.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -240,8 +240,7 @@ static void nft_rbtree_gc_remove(struct
static int nft_rbtree_gc_elem(const struct nft_set *__set,
struct nft_rbtree *priv,
- struct nft_rbtree_elem *rbe,
- u8 genmask)
+ struct nft_rbtree_elem *rbe)
{
struct nft_set *set = (struct nft_set *)__set;
struct rb_node *prev = rb_prev(&rbe->node);
@@ -260,7 +259,7 @@ static int nft_rbtree_gc_elem(const stru
while (prev) {
rbe_prev = rb_entry(prev, struct nft_rbtree_elem, node);
if (nft_rbtree_interval_end(rbe_prev) &&
- nft_set_elem_active(&rbe_prev->ext, genmask))
+ nft_set_elem_active(&rbe_prev->ext, NFT_GENMASK_ANY))
break;
prev = rb_prev(prev);
@@ -368,7 +367,7 @@ static int __nft_rbtree_insert(const str
*/
if (nft_set_elem_expired(&rbe->ext) &&
nft_set_elem_active(&rbe->ext, cur_genmask)) {
- err = nft_rbtree_gc_elem(set, priv, rbe, genmask);
+ err = nft_rbtree_gc_elem(set, priv, rbe);
if (err < 0)
return err;
Patches currently in stable-queue which might be from kroah.com@xxxxxxxxxxxxxxx are
queue-4.19/netfilter-nf_tables-bogus-ebusy-when-deleting-flowtable-after-flush-for-4.19.patch
queue-4.19/netfilter-nft_set_rbtree-switch-to-node-list-walk-for-overlap-detection.patch
queue-4.19/netfilter-nf_tables-validate-nfproto_-family.patch
queue-4.19/netfilter-nf_tables-unregister-flowtable-hooks-on-netns-exit.patch
queue-4.19/netfilter-nf_tables-fix-gc-transaction-races-with-netns-and-netlink-event-exit-path.patch
queue-4.19/netfilter-nft_set_rbtree-use-read-spinlock-to-avoid-datapath-contention.patch
queue-4.19/netfilter-nft_dynset-report-eopnotsupp-on-missing-set-feature.patch
queue-4.19/netfilter-nf_tables-discard-table-flag-update-with-pending-basechain-deletion.patch
queue-4.19/netfilter-nft_set_rbtree-skip-sync-gc-for-new-elements-in-this-transaction.patch
queue-4.19/netfilter-nf_tables-mark-set-as-dead-when-unbinding-anonymous-set-with-timeout.patch
queue-4.19/netfilter-nf_tables-reject-new-basechain-after-table-flag-update.patch
queue-4.19/netfilter-nf_tables-gc-transaction-race-with-netns-dismantle.patch
queue-4.19/netfilter-nftables-update-table-flags-from-the-commit-phase.patch
queue-4.19/netfilter-nf_tables-allow-nfproto_inet-in-nft_-match-target-_validate.patch
queue-4.19/netfilter-nft_set_rbtree-skip-end-interval-element-from-gc.patch
queue-4.19/netfilter-nf_tables-drop-map-element-references-from-preparation-phase.patch
queue-4.19/netfilter-nf_tables-gc-transaction-race-with-abort-path.patch
queue-4.19/netfilter-nf_tables-fix-memleak-when-more-than-255-elements-expired.patch
queue-4.19/netfilter-nft_set_rbtree-add-missing-expired-checks.patch
queue-4.19/netfilter-nf_tables-double-hook-unregistration-in-netns-path.patch
queue-4.19/netfilter-nft_dynset-relax-superfluous-check-on-set-updates.patch
queue-4.19/netfilter-nf_tables-defer-gc-run-if-previous-batch-is-still-pending.patch
queue-4.19/netfilter-nft_set_hash-try-later-when-gc-hits-eagain-on-iteration.patch
queue-4.19/netfilter-nft_dynset-fix-timeouts-later-than-23-days.patch
queue-4.19/netfilter-nf_tables-mark-newset-as-dead-on-transaction-abort.patch
queue-4.19/netfilter-nf_tables-don-t-skip-expired-elements-during-walk.patch
queue-4.19/netfilter-nftables-rename-set-element-data-activation-deactivation-functions.patch
queue-4.19/netfilter-nf_tables-gc-transaction-api-to-avoid-race-with-control-plane.patch
queue-4.19/netfilter-nf_tables-set-dormant-flag-on-hook-register-failure.patch
queue-4.19/netfilter-nf_tables-remove-busy-mark-and-gc-batch-api.patch
queue-4.19/netfilter-nf_tables-skip-dead-set-elements-in-netlink-dump.patch
queue-4.19/netfilter-nf_tables-adapt-set-backend-to-use-gc-transaction-api.patch
queue-4.19/netfilter-nft_set_rbtree-fix-overlap-expiration-walk.patch
queue-4.19/netfilter-nf_tables-fix-table-flag-updates.patch
queue-4.19/netfilter-nf_tables-do-not-compare-internal-table-flags-on-updates.patch
queue-4.19/netfilter-nft_set_rbtree-allow-loose-matching-of-closing-element-in-interval.patch
queue-4.19/netfilter-nftables-exthdr-fix-4-byte-stack-oob-write.patch
queue-4.19/netfilter-nft_set_rbtree-fix-null-deref-on-element-insertion.patch
queue-4.19/netfilter-nf_tables-pass-context-to-nft_set_destroy.patch
queue-4.19/netfilter-nf_tables-disable-toggling-dormant-table-state-more-than-once.patch
