Commit bf072247 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by sanglipeng1
Browse files

netfilter: nf_tables: skip dead set elements in netlink dump 

stable inclusion
from stable-v5.10.209
commit 9a4d25267d503072cfda2e7ecf30117b89046d6c
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I9U3NW

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9a4d25267d503072cfda2e7ecf30117b89046d6c



--------------------------------

[ Upstream commit 6b1ca88e4bb63673dc9f9c7f23c899f22c3cb17a ]

Delete from packet path relies on the garbage collector to purge
elements with NFT_SET_ELEM_DEAD_BIT on.

Skip these dead elements from nf_tables_dump_setelem() path, I very
rarely see tests/shell/testcases/maps/typeof_maps_add_delete reports
[DUMP FAILED] showing a mismatch in the expected output with an element
that should not be there.

If the netlink dump happens before GC worker run, it might show dead
elements in the ruleset listing.

nft_rhash_get() already skips dead elements in nft_rhash_cmp(),
therefore, it already does not show the element when getting a single
element via netlink control plane.

Fixes: 5f68718b ("netfilter: nf_tables: GC transaction API to avoid race with control plane")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarsanglipeng1 <sanglipeng1@jd.com>
parent 9a8ac4d3

net/netfilter/nf_tables_api.c

+1 −1
Original line number Diff line number Diff line
@@ -5050,7 +5050,7 @@ static int nf_tables_dump_setelem(const struct nft_ctx *ctx, 
	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);

	struct nft_set_dump_args *args;



	if (nft_set_elem_expired(ext))

	if (nft_set_elem_expired(ext) || nft_set_elem_is_dead(ext))

		return 0;



	args = container_of(iter, struct nft_set_dump_args, iter);