Skip to content

Commit 2ee52ae

Browse files
ummakynesFlorian Westphal
authored andcommitted
netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
New elements in this transaction might expired before such transaction ends. Skip sync GC for such elements otherwise commit path might walk over an already released object. Once transaction is finished, async GC will collect such expired element. Fixes: f6c383b ("netfilter: nf_tables: adapt set backend to use GC transaction API") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
1 parent fdc04cc commit 2ee52ae

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

net/netfilter/nft_set_rbtree.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -312,6 +312,7 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
312312
struct nft_rbtree_elem *rbe, *rbe_le = NULL, *rbe_ge = NULL;
313313
struct rb_node *node, *next, *parent, **p, *first = NULL;
314314
struct nft_rbtree *priv = nft_set_priv(set);
315+
u8 cur_genmask = nft_genmask_cur(net);
315316
u8 genmask = nft_genmask_next(net);
316317
int d, err;
317318

@@ -357,8 +358,11 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,
357358
if (!nft_set_elem_active(&rbe->ext, genmask))
358359
continue;
359360

360-
/* perform garbage collection to avoid bogus overlap reports. */
361-
if (nft_set_elem_expired(&rbe->ext)) {
361+
/* perform garbage collection to avoid bogus overlap reports
362+
* but skip new elements in this transaction.
363+
*/
364+
if (nft_set_elem_expired(&rbe->ext) &&
365+
nft_set_elem_active(&rbe->ext, cur_genmask)) {
362366
err = nft_rbtree_gc_elem(set, priv, rbe, genmask);
363367
if (err < 0)
364368
return err;

0 commit comments

Comments
 (0)