Commit 0447f464 authored by Alexander Maltsev's avatar Alexander Maltsev Committed by Liu Jian
Browse files

netfilter: ipset: Add list flush to cancel_gc 

stable inclusion
from stable-v6.6.33
commit 5278e4354a5b6b6af4b5e8abd25348a909c1b476
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACQJH
CVE: CVE-2024-39503

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5278e4354a5b6b6af4b5e8abd25348a909c1b476



---------------------------

[ Upstream commit c1193d9bbbd379defe9be3c6de566de684de8a6f ]

Flushing list in cancel_gc drops references to other lists right away,
without waiting for RCU to destroy list. Fixes race when referenced
ipsets can't be destroyed while referring list is scheduled for destroy.

Fixes: 97f7cf1cd80e ("netfilter: ipset: fix performance regression in swap operation")
Signed-off-by: default avatarAlexander Maltsev <keltar.gw@gmail.com>
Acked-by: default avatarJozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
parent dbf4bac0

net/netfilter/ipset/ip_set_list_set.c

+3 −0
Original line number Diff line number Diff line
@@ -549,6 +549,9 @@ list_set_cancel_gc(struct ip_set *set) 


	if (SET_WITH_TIMEOUT(set))

		timer_shutdown_sync(&map->gc);



	/* Flush list to drop references to other ipsets */

	list_set_flush(set);

}



static const struct ip_set_type_variant set_variant = {