From: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
commit 2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4 upstream.
New elements in this transaction might expired before such transaction
ends. Skip sync GC for such elements otherwise commit path might walk
over an already released object. Once transaction is finished, async GC
will collect such expired element.
Fixes: f6c383b8c31a ("netfilter: nf_tables: adapt set backend to use GC transaction API")
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/netfilter/nft_set_rbtree.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -317,6 +317,7 @@ static int __nft_rbtree_insert(const str
struct nft_rbtree_elem *rbe, *rbe_le = NULL, *rbe_ge = NULL;
struct rb_node *node, *next, *parent, **p, *first = NULL;
struct nft_rbtree *priv = nft_set_priv(set);
+ u8 cur_genmask = nft_genmask_cur(net);
u8 genmask = nft_genmask_next(net);
int d, err;
@@ -362,8 +363,11 @@ static int __nft_rbtree_insert(const str
if (!nft_set_elem_active(&rbe->ext, genmask))
continue;
- /* perform garbage collection to avoid bogus overlap reports. */
- if (nft_set_elem_expired(&rbe->ext)) {
+ /* perform garbage collection to avoid bogus overlap reports
+ * but skip new elements in this transaction.
+ */
+ if (nft_set_elem_expired(&rbe->ext) &&
+ nft_set_elem_active(&rbe->ext, cur_genmask)) {
err = nft_rbtree_gc_elem(set, priv, rbe, genmask);
if (err < 0)
return err;
Patches currently in stable-queue which might be from kroah.com@xxxxxxxxxxxxxxx are
queue-4.19/netfilter-nf_tables-bogus-ebusy-when-deleting-flowtable-after-flush-for-4.19.patch
queue-4.19/netfilter-nft_set_rbtree-switch-to-node-list-walk-for-overlap-detection.patch
queue-4.19/netfilter-nf_tables-validate-nfproto_-family.patch
queue-4.19/netfilter-nf_tables-unregister-flowtable-hooks-on-netns-exit.patch
queue-4.19/netfilter-nf_tables-fix-gc-transaction-races-with-netns-and-netlink-event-exit-path.patch
queue-4.19/netfilter-nft_set_rbtree-use-read-spinlock-to-avoid-datapath-contention.patch
queue-4.19/netfilter-nft_dynset-report-eopnotsupp-on-missing-set-feature.patch
queue-4.19/netfilter-nf_tables-discard-table-flag-update-with-pending-basechain-deletion.patch
queue-4.19/netfilter-nft_set_rbtree-skip-sync-gc-for-new-elements-in-this-transaction.patch
queue-4.19/netfilter-nf_tables-mark-set-as-dead-when-unbinding-anonymous-set-with-timeout.patch
queue-4.19/netfilter-nf_tables-reject-new-basechain-after-table-flag-update.patch
queue-4.19/netfilter-nf_tables-gc-transaction-race-with-netns-dismantle.patch
queue-4.19/netfilter-nftables-update-table-flags-from-the-commit-phase.patch
queue-4.19/netfilter-nf_tables-allow-nfproto_inet-in-nft_-match-target-_validate.patch
queue-4.19/netfilter-nft_set_rbtree-skip-end-interval-element-from-gc.patch
queue-4.19/netfilter-nf_tables-drop-map-element-references-from-preparation-phase.patch
queue-4.19/netfilter-nf_tables-gc-transaction-race-with-abort-path.patch
queue-4.19/netfilter-nf_tables-fix-memleak-when-more-than-255-elements-expired.patch
queue-4.19/netfilter-nft_set_rbtree-add-missing-expired-checks.patch
queue-4.19/netfilter-nf_tables-double-hook-unregistration-in-netns-path.patch
queue-4.19/netfilter-nft_dynset-relax-superfluous-check-on-set-updates.patch
queue-4.19/netfilter-nf_tables-defer-gc-run-if-previous-batch-is-still-pending.patch
queue-4.19/netfilter-nft_set_hash-try-later-when-gc-hits-eagain-on-iteration.patch
queue-4.19/netfilter-nft_dynset-fix-timeouts-later-than-23-days.patch
queue-4.19/netfilter-nf_tables-mark-newset-as-dead-on-transaction-abort.patch
queue-4.19/netfilter-nf_tables-don-t-skip-expired-elements-during-walk.patch
queue-4.19/netfilter-nftables-rename-set-element-data-activation-deactivation-functions.patch
queue-4.19/netfilter-nf_tables-gc-transaction-api-to-avoid-race-with-control-plane.patch
queue-4.19/netfilter-nf_tables-set-dormant-flag-on-hook-register-failure.patch
queue-4.19/netfilter-nf_tables-remove-busy-mark-and-gc-batch-api.patch
queue-4.19/netfilter-nf_tables-skip-dead-set-elements-in-netlink-dump.patch
queue-4.19/netfilter-nf_tables-adapt-set-backend-to-use-gc-transaction-api.patch
queue-4.19/netfilter-nft_set_rbtree-fix-overlap-expiration-walk.patch
queue-4.19/netfilter-nf_tables-fix-table-flag-updates.patch
queue-4.19/netfilter-nf_tables-do-not-compare-internal-table-flags-on-updates.patch
queue-4.19/netfilter-nft_set_rbtree-allow-loose-matching-of-closing-element-in-interval.patch
queue-4.19/netfilter-nftables-exthdr-fix-4-byte-stack-oob-write.patch
queue-4.19/netfilter-nft_set_rbtree-fix-null-deref-on-element-insertion.patch
queue-4.19/netfilter-nf_tables-pass-context-to-nft_set_destroy.patch
queue-4.19/netfilter-nf_tables-disable-toggling-dormant-table-state-more-than-once.patch
