Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2218777/?format=api
{ "id": 2218777, "url": "http://patchwork.ozlabs.org/api/patches/2218777/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20260401215957.1178188-1-tim.whisonant@canonical.com/", "project": { "id": 15, "url": "http://patchwork.ozlabs.org/api/projects/15/?format=api", "name": "Ubuntu Kernel", "link_name": "ubuntu-kernel", "list_id": "kernel-team.lists.ubuntu.com", "list_email": "kernel-team@lists.ubuntu.com", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260401215957.1178188-1-tim.whisonant@canonical.com>", "list_archive_url": null, "date": "2026-04-01T21:59:56", "name": "[SRU,N,1/1] netfilter: nft_set_pipapo: split gc into unlink and reclaim phase", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "4e224060b4e02ef33d07ac2cf212143fda55e0d6", "submitter": { "id": 89903, "url": "http://patchwork.ozlabs.org/api/people/89903/?format=api", "name": "Tim Whisonant", "email": "tim.whisonant@canonical.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/20260401215957.1178188-1-tim.whisonant@canonical.com/mbox/", "series": [ { "id": 498399, "url": "http://patchwork.ozlabs.org/api/series/498399/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/list/?series=498399", "date": "2026-04-01T21:59:52", "name": "CVE-2026-23351", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/498399/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2218777/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2218777/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<kernel-team-bounces@lists.ubuntu.com>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=X+r7IMfw;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fmJnS6HsTz1yCs\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 02 Apr 2026 09:00:12 +1100 (AEDT)", "from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1w83bX-0007gq-Oc; Wed, 01 Apr 2026 22:00:03 +0000", "from smtp-relay-internal-0.internal ([10.131.114.225]\n helo=smtp-relay-internal-0.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from <tim.whisonant@canonical.com>)\n id 1w83bX-0007ft-2I\n for kernel-team@lists.ubuntu.com; Wed, 01 Apr 2026 22:00:03 +0000", "from mail-oi1-f197.google.com (mail-oi1-f197.google.com\n [209.85.167.197])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id D22AC3F27F\n for <kernel-team@lists.ubuntu.com>; Wed, 1 Apr 2026 22:00:02 +0000 (UTC)", "by mail-oi1-f197.google.com with SMTP id\n 5614622812f47-463a075e177so573852b6e.2\n for <kernel-team@lists.ubuntu.com>; Wed, 01 Apr 2026 15:00:02 -0700 (PDT)", "from localhost (104-6-108-11.lightspeed.frokca.sbcglobal.net.\n [104.6.108.11]) by smtp.gmail.com with ESMTPSA id\n 5614622812f47-46d9387a763sm491968b6e.18.2026.04.01.14.59.58\n for <kernel-team@lists.ubuntu.com>\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Wed, 01 Apr 2026 15:00:00 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1775080802;\n bh=gm5e343TljeGwfyFJwHiaiGGxgZCDwgB1pjPRKz6jW0=;\n h=From:To:Subject:Date:Message-ID:In-Reply-To:References:\n MIME-Version;\n b=X+r7IMfwaP0gzO8Jq53pUtPtS3RKmNIun7Gfho8zVQUen0Bjfwp/XufJu/uz2DSfc\n pudzvyVV7VjZ48MSZdFVHeD2qLcl0vaDjAIDAX+5r6zXby94owOkEB+rIHG5kVEa07\n 6Wf9ZhrBJaR197hQ5uH+aG1PaXcgTB8qpUQ6NYuoueJkkilZmQvkB4BVMMBh8V9CoG\n vsLxlhHBAzdc8/fBw8FiUDnEiUF6pqgj0eO/IprTmp6DDO2AyTU/piXveoe6rXoEot\n 2mbT48T/h1TzK8iZRgBeam/OqGRBKklz0gzsUlQkObyceFJJYiNmw7JYMU48yqb++1\n +HL05GR6fm4VmHar/ez8dK0GZWLE20F1MJpq4SHQN8JhJIsRB2HRXsQ8LMbNja3RZR\n /gZ7Fn4Ak3/wCPVER+d/Q9lZY2ADIaqT7XRCSnN20SnPy+zyvo/rxGZiMdEzqsgN7H\n yaoozoXIYGQ0Ygs0HUb+CIQkLpBJ3yTCsKpyx5lfkXuMtYlRUkvqgjbO+6/gLXlFsf\n 0DNGQZLh3qJFZgJ2Q6jO32a3REMQltWmDb4qxRxeQ3FdDuxtuzJX5zO6VvY9GmqdtO\n wgObEHNMd3Bwh6av0L1UWmD/pZoJLs8awG7v/hGnUht6PvmuVmlE4oMEbONZw9YHOr\n YelWrQSzJDlSAcxMFKSfLdhw=", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1775080801; x=1775685601;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to\n :cc:subject:date:message-id:reply-to;\n bh=gm5e343TljeGwfyFJwHiaiGGxgZCDwgB1pjPRKz6jW0=;\n b=b4CBJ1yhWseiU0BzM7ijwWpYthsbYLhmkGxf07uUx+XS1vLkI30ebeWyjuvxkK/7cV\n w4hYsAn9st8iCXIlnidzVm0S1cDd3gLWFxjGblI22nLMjcEu2JoIum29zh2AKGvLPneJ\n oJPJ2n/H5hwfRfLfRq6WtqOTTY0FNyWazeMsg8qdbghgE39r3GMBNpHCWWgwYMWlYhMy\n o1ALAqRIQoCqhwPsKtATOpzKiRQXzzuQiE0Hfcz2D7NCDs9wDkbOmNkcAwnrT8bMYEW2\n 5xI9a/Rum+1YAQLyNprmdtsvZuQlO2s5HO1HGACpEXbaU7s0D222KNPtuujOM8GsvEs9\n jkrg==", "X-Gm-Message-State": "AOJu0YwL0GX5Dspvc3aOMwqG6WgUSPHMCqtBau9ZKdOGwcCvGO1gQouv\n S+f2J7L869JQtUglNdjLhoTtQBjH7h0CV09kXnJBlBdlyasrmXskdJ0PRPoVOmyfPdVIDGHIMqN\n VB1iiJqC/oEoYqVg+jbDFfyawY5yV44+DN2VV+x06YTg2205eT6BwQ5gjyFNKpe/Sfp9VA8Ga83\n rp63IXv/Co7/HTdg==", "X-Gm-Gg": "ATEYQzywgEBoqd883ZeSxxw7Z7951KVssUjvQ0QoyEQunQhiptxmkUHdUb9atDYDvMW\n axg+QB9/Yj+5B2+8me+Wef527Nzs9SJMTO/E2POkEFEbRhoMiEBdt/eEw/mehL5WIjD1lBLKc1N\n EZ4GKD8AmYCILz2Uobt0wRxSrtXFftO6wLk6HuM329QPM5vWJcsxVwgiFxaPt2PDtW7JAzuhIvh\n ZDzw0roaDnvBVgRYykANm32HEgJgR5SLps6Ba9s8pNptgMj0blodzUUFzUmzdGQ70mNY+hl0aJI\n YmrE+lILpIcjxvVlousWkttQf7Aon/Gbn0yd8fE1gF7rydGeEpbLtQxxauPXBlfEzCuQm2IdYiy\n ceVW0LW9ib77jeOC2+9+i1mx4IYvYin7p5FoJZlEeIrS4F0PBijm/B1hVkeodNYADz98gQd9VAd\n H/Hg==", "X-Received": [ "by 2002:a54:4390:0:b0:468:6a2:897 with SMTP id\n 5614622812f47-46adff8aa48mr2143930b6e.6.1775080801088;\n Wed, 01 Apr 2026 15:00:01 -0700 (PDT)", "by 2002:a54:4390:0:b0:468:6a2:897 with SMTP id\n 5614622812f47-46adff8aa48mr2143923b6e.6.1775080800610;\n Wed, 01 Apr 2026 15:00:00 -0700 (PDT)" ], "From": "Tim Whisonant <tim.whisonant@canonical.com>", "To": "kernel-team@lists.ubuntu.com", "Subject": "[SRU][N][PATCH 1/1] netfilter: nft_set_pipapo: split gc into unlink\n and reclaim phase", "Date": "Wed, 1 Apr 2026 14:59:56 -0700", "Message-ID": "<20260401215957.1178188-1-tim.whisonant@canonical.com>", "X-Mailer": "git-send-email 2.43.0", "In-Reply-To": "<20260401215954.1178152-1-tim.whisonant@canonical.com>", "References": "<20260401215954.1178152-1-tim.whisonant@canonical.com>", "MIME-Version": "1.0", "X-BeenThere": "kernel-team@lists.ubuntu.com", "X-Mailman-Version": "2.1.20", "Precedence": "list", "List-Id": "Kernel team discussions <kernel-team.lists.ubuntu.com>", "List-Unsubscribe": "<https://lists.ubuntu.com/mailman/options/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>", "List-Archive": "<https://lists.ubuntu.com/archives/kernel-team>", "List-Post": "<mailto:kernel-team@lists.ubuntu.com>", "List-Help": "<mailto:kernel-team-request@lists.ubuntu.com?subject=help>", "List-Subscribe": "<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>", "Content-Type": "text/plain; charset=\"utf-8\"", "Content-Transfer-Encoding": "base64", "Errors-To": "kernel-team-bounces@lists.ubuntu.com", "Sender": "\"kernel-team\" <kernel-team-bounces@lists.ubuntu.com>" }, "content": "From: Florian Westphal <fw@strlen.de>\n\ncommit 9df95785d3d8302f7c066050117b04cd3c2048c2 upstream.\n\nYiming Qian reports Use-after-free in the pipapo set type:\n Under a large number of expired elements, commit-time GC can run for a very\n long time in a non-preemptible context, triggering soft lockup warnings and\n RCU stall reports (local denial of service).\n\nWe must split GC in an unlink and a reclaim phase.\n\nWe cannot queue elements for freeing until pointers have been swapped.\nExpired elements are still exposed to both the packet path and userspace\ndumpers via the live copy of the data structure.\n\ncall_rcu() does not protect us: dump operations or element lookups starting\nafter call_rcu has fired can still observe the free'd element, unless the\ncommit phase has made enough progress to swap the clone and live pointers\nbefore any new reader has picked up the old version.\n\nThis a similar approach as done recently for the rbtree backend in commit\n35f83a75529a (\"netfilter: nft_set_rbtree: don't gc elements on insert\").\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReported-by: Yiming Qian <yimingqian591@gmail.com>\nSigned-off-by: Florian Westphal <fw@strlen.de>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n(backported from commit 7864c667aed01a58b87ca518a631322cd0ac34c0 linux-6.6.y)\n[tswhison: this kernel had the following patch, but the backport\ndonor kernel did not:\nffb40fba404 (\"netfilter: nft_set_pipapo: prefer gfp_kernel allocation\")\nMade a small adjustment based on this.]\nCVE-2026-23351\nSigned-off-by: Tim Whisonant <tim.whisonant@canonical.com>\n---\n include/net/netfilter/nf_tables.h | 5 +++\n net/netfilter/nf_tables_api.c | 5 ---\n net/netfilter/nft_set_pipapo.c | 51 ++++++++++++++++++++++++++-----\n net/netfilter/nft_set_pipapo.h | 2 ++\n 4 files changed, 50 insertions(+), 13 deletions(-)", "diff": "diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h\nindex 590c42611c633..ab0d565956977 100644\n--- a/include/net/netfilter/nf_tables.h\n+++ b/include/net/netfilter/nf_tables.h\n@@ -1768,6 +1768,11 @@ struct nft_trans_gc {\n \tstruct rcu_head\t\trcu;\n };\n \n+static inline int nft_trans_gc_space(const struct nft_trans_gc *trans)\n+{\n+\treturn NFT_TRANS_GC_BATCHCOUNT - trans->count;\n+}\n+\n struct nft_trans_gc *nft_trans_gc_alloc(struct nft_set *set,\n \t\t\t\t\tunsigned int gc_seq, gfp_t gfp);\n void nft_trans_gc_destroy(struct nft_trans_gc *trans);\ndiff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c\nindex 75d82bd17dea6..0c34c5d57d3b5 100644\n--- a/net/netfilter/nf_tables_api.c\n+++ b/net/netfilter/nf_tables_api.c\n@@ -10001,11 +10001,6 @@ static void nft_trans_gc_queue_work(struct nft_trans_gc *trans)\n \tschedule_work(&trans_gc_work);\n }\n \n-static int nft_trans_gc_space(struct nft_trans_gc *trans)\n-{\n-\treturn NFT_TRANS_GC_BATCHCOUNT - trans->count;\n-}\n-\n struct nft_trans_gc *nft_trans_gc_queue_async(struct nft_trans_gc *gc,\n \t\t\t\t\t unsigned int gc_seq, gfp_t gfp)\n {\ndiff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex 940b447e45d3f..3825c803bea80 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -1609,11 +1609,11 @@ static void nft_pipapo_gc_deactivate(struct net *net, struct nft_set *set,\n }\n \n /**\n- * pipapo_gc() - Drop expired entries from set, destroy start and end elements\n+ * pipapo_gc_scan() - Drop expired entries from set and link them to gc list\n * @set:\tnftables API set representation\n * @m:\t\tMatching data\n */\n-static void pipapo_gc(struct nft_set *set, struct nft_pipapo_match *m)\n+static void pipapo_gc_scan(struct nft_set *set, struct nft_pipapo_match *m)\n {\n \tstruct nft_pipapo *priv = nft_set_priv(set);\n \tstruct net *net = read_pnet(&set->net);\n@@ -1626,6 +1626,8 @@ static void pipapo_gc(struct nft_set *set, struct nft_pipapo_match *m)\n \tif (!gc)\n \t\treturn;\n \n+\tlist_add(&gc->list, &priv->gc_head);\n+\n \twhile ((rules_f0 = pipapo_rules_same_key(m->f, first_rule))) {\n \t\tunion nft_pipapo_map_bucket rulemap[NFT_PIPAPO_MAX_FIELDS];\n \t\tconst struct nft_pipapo_field *f;\n@@ -1655,9 +1657,13 @@ static void pipapo_gc(struct nft_set *set, struct nft_pipapo_match *m)\n \t\tif (__nft_set_elem_expired(&e->ext, tstamp)) {\n \t\t\tpriv->dirty = true;\n \n-\t\t\tgc = nft_trans_gc_queue_sync(gc, GFP_KERNEL);\n-\t\t\tif (!gc)\n-\t\t\t\treturn;\n+\t\t\tif (!nft_trans_gc_space(gc)) {\n+\t\t\t\tgc = nft_trans_gc_alloc(set, 0, GFP_KERNEL);\n+\t\t\t\tif (!gc)\n+\t\t\t\t\treturn;\n+\n+\t\t\t\tlist_add(&gc->list, &priv->gc_head);\n+\t\t\t}\n \n \t\t\tnft_pipapo_gc_deactivate(net, set, e);\n \t\t\tpipapo_drop(m, rulemap);\n@@ -1671,10 +1677,30 @@ static void pipapo_gc(struct nft_set *set, struct nft_pipapo_match *m)\n \t\t}\n \t}\n \n-\tgc = nft_trans_gc_catchall_sync(gc);\n+\tpriv->last_gc = jiffies;\n+}\n+\n+/**\n+ * pipapo_gc_queue() - Free expired elements\n+ * @set:\tnftables API set representation\n+ */\n+static void pipapo_gc_queue(struct nft_set *set)\n+{\n+\tstruct nft_pipapo *priv = nft_set_priv(set);\n+\tstruct nft_trans_gc *gc, *next;\n+\n+\t/* always do a catchall cycle: */\n+\tgc = nft_trans_gc_alloc(set, 0, GFP_KERNEL);\n \tif (gc) {\n+\t\tgc = nft_trans_gc_catchall_sync(gc);\n+\t\tif (gc)\n+\t\t\tnft_trans_gc_queue_sync_done(gc);\n+\t}\n+\n+\t/* always purge queued gc elements. */\n+\tlist_for_each_entry_safe(gc, next, &priv->gc_head, list) {\n+\t\tlist_del(&gc->list);\n \t\tnft_trans_gc_queue_sync_done(gc);\n-\t\tpriv->last_gc = jiffies;\n \t}\n }\n \n@@ -1728,6 +1754,10 @@ static void pipapo_reclaim_match(struct rcu_head *rcu)\n *\n * We also need to create a new working copy for subsequent insertions and\n * deletions.\n+ *\n+ * After the live copy has been replaced by the clone, we can safely queue\n+ * expired elements that have been collected by pipapo_gc_scan() for\n+ * memory reclaim.\n */\n static void nft_pipapo_commit(struct nft_set *set)\n {\n@@ -1735,7 +1765,7 @@ static void nft_pipapo_commit(struct nft_set *set)\n \tstruct nft_pipapo_match *new_clone, *old;\n \n \tif (time_after_eq(jiffies, priv->last_gc + nft_set_gc_interval(set)))\n-\t\tpipapo_gc(set, priv->clone);\n+\t\tpipapo_gc_scan(set, priv->clone);\n \n \tif (!priv->dirty)\n \t\treturn;\n@@ -1752,6 +1782,8 @@ static void nft_pipapo_commit(struct nft_set *set)\n \t\tcall_rcu(&old->rcu, pipapo_reclaim_match);\n \n \tpriv->clone = new_clone;\n+\n+\tpipapo_gc_queue(set);\n }\n \n static bool nft_pipapo_transaction_mutex_held(const struct nft_set *set)\n@@ -2222,6 +2254,7 @@ static int nft_pipapo_init(const struct nft_set *set,\n \n \tpriv->dirty = false;\n \n+\tINIT_LIST_HEAD(&priv->gc_head);\n \trcu_assign_pointer(priv->match, m);\n \n \treturn 0;\n@@ -2274,6 +2307,8 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n \tstruct nft_pipapo_match *m;\n \tint cpu;\n \n+\tWARN_ON_ONCE(!list_empty(&priv->gc_head));\n+\n \tm = rcu_dereference_protected(priv->match, true);\n \tif (m) {\n \t\trcu_barrier();\ndiff --git a/net/netfilter/nft_set_pipapo.h b/net/netfilter/nft_set_pipapo.h\nindex be5d9e94a6b4b..9e20e58fb4638 100644\n--- a/net/netfilter/nft_set_pipapo.h\n+++ b/net/netfilter/nft_set_pipapo.h\n@@ -165,6 +165,7 @@ struct nft_pipapo_match {\n * @width:\tTotal bytes to be matched for one packet, including padding\n * @dirty:\tWorking copy has pending insertions or deletions\n * @last_gc:\tTimestamp of last garbage collection run, jiffies\n+ * @gc_head:\tlist of nft_trans_gc to queue up for mem reclaim\n */\n struct nft_pipapo {\n \tstruct nft_pipapo_match __rcu *match;\n@@ -172,6 +173,7 @@ struct nft_pipapo {\n \tint width;\n \tbool dirty;\n \tunsigned long last_gc;\n+\tstruct list_head gc_head;\n };\n \n struct nft_pipapo_elem;\n", "prefixes": [ "SRU", "N", "1/1" ] }