{"id":2235202,"url":"http://patchwork.ozlabs.org/api/1.2/patches/2235202/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260508205903.10238-2-kadlec@netfilter.org/","project":{"id":26,"url":"http://patchwork.ozlabs.org/api/1.2/projects/26/?format=json","name":"Netfilter Development","link_name":"netfilter-devel","list_id":"netfilter-devel.vger.kernel.org","list_email":"netfilter-devel@vger.kernel.org","web_url":null,"scm_url":null,"webscm_url":null,"list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20260508205903.10238-2-kadlec@netfilter.org>","list_archive_url":null,"date":"2026-05-08T20:58:56","name":"[v6,1/8] netfilter: ipset: fix a potential dump-destroy race","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"47214cd0628d6d80d4010521ca88d9add2fdc755","submitter":{"id":77226,"url":"http://patchwork.ozlabs.org/api/1.2/people/77226/?format=json","name":"Jozsef Kadlecsik","email":"kadlec@netfilter.org"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260508205903.10238-2-kadlec@netfilter.org/mbox/","series":[{"id":503447,"url":"http://patchwork.ozlabs.org/api/1.2/series/503447/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=503447","date":"2026-05-08T20:58:57","name":"netfilter: ipset fixes","version":6,"mbox":"http://patchwork.ozlabs.org/series/503447/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2235202/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2235202/checks/","tags":{},"related":[],"headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=blackhole.kfki.hu header.i=@blackhole.kfki.hu\n header.a=rsa-sha256 header.s=20151130 header.b=NfLBCWSD;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=172.234.253.10; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12512-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (1024-bit key) header.d=blackhole.kfki.hu\n header.i=@blackhole.kfki.hu header.b=\"NfLBCWSD\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=148.6.0.50","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=blackhole.kfki.hu"],"Received":["from sea.lore.kernel.org (sea.lore.kernel.org [172.234.253.10])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4gC1pW2tkKz1yK7\n\tfor ; Sat, 09 May 2026 07:04:51 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id BD862304455D\n\tfor ; Fri, 8 May 2026 21:04:22 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id A2503361679;\n\tFri, 8 May 2026 21:04:21 +0000 (UTC)","from smtp-out.kfki.hu (smtp-out.kfki.hu [148.6.0.50])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 58A7B33E35B\n\tfor ; Fri, 8 May 2026 21:04:17 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n\tby smtp1.kfki.hu (Postfix) with ESMTP id 4gC1gt4SqhzGFDNR;\n\tFri, 8 May 2026 22:59:06 +0200 (CEST)","from smtp1.kfki.hu ([127.0.0.1])\n by localhost (smtp1.kfki.hu [127.0.0.1]) (amavis, port 10026) with ESMTP\n id zrmtHEsaVUiF; Fri, 8 May 2026 22:59:04 +0200 (CEST)","from mentat.rmki.kfki.hu (254C131D.nat.pool.telekom.hu\n [37.76.19.29])\n\t(Authenticated sender: kadlecsik.jozsef@wigner.hu)\n\tby smtp1.kfki.hu (Postfix) with ESMTPSA id 4gC1gr4yDVzGFDNK;\n\tFri, 8 May 2026 22:59:04 +0200 (CEST)","by mentat.rmki.kfki.hu (Postfix, from userid 1000)\n\tid E84981408C5; Fri, 8 May 2026 22:59:03 +0200 (CEST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1778274261; cv=none;\n b=TcngEG2TR6WXLMdI9aNRnRUSPYE86olD2kTr3sakAwkA57j+PXgohbBbIkeYPFJOr1ZIa3hU7UOYC6eROKaeRIfvAqrsvOO0YXohH55xkLliiVoC1nwULLs7JRugLXfJoc9lt57awzFdVCgtOID3SNo65Y5gbTxe/Hfit8dQMEY=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1778274261; c=relaxed/simple;\n\tbh=PweMeeNiWetmI1IlqZYsffCOo6DRZfNO60rlsv7kr9c=;\n\th=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:\n\t MIME-Version;\n b=gi37PsYrBYoPPKUjZOpmP0ALjaApVFDMokb/KeW5b55dotnOu7ec6ECLdtVriXoLOb6llsvkGTzYgOQA64s5MdENmE0segN5FVNdMX8fMXE2LYuLAz6WQmGh1M440zE+OD3vk6113t44TCoqZpTL1F3mZjkPgIesumpBeY7iDdk=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org;\n spf=pass smtp.mailfrom=blackhole.kfki.hu;\n dkim=pass (1024-bit key) header.d=blackhole.kfki.hu\n header.i=@blackhole.kfki.hu header.b=NfLBCWSD;\n arc=none smtp.client-ip=148.6.0.50","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=\n\tblackhole.kfki.hu; h=mime-version:references:in-reply-to\n\t:x-mailer:message-id:date:date:from:from:received:received\n\t:received; s=20151130; t=1778273944; x=1780088345; bh=iOqXsFHMy7\n\tY7qcmN400r3PykLdkYw5JCX7S3PYF8nD0=; b=NfLBCWSDVdu5u9rPRNAkfYG6qo\n\tt8r+LLhDpOgNrld9bWiJmVFdrz3AItXuklOXLZRDU1rntfoYcAufY8KsZvA7MeV9\n\tRCnwS1eNI59YFnRvao2vr9kSi+ZwT6D7pZ232KHlNZmcB0ZTzdbXiz9/Q86D4HKo\n\t6npKHtu5YSPbOSG5g=","X-Virus-Scanned":"Debian amavis at smtp1.kfki.hu","From":"Jozsef Kadlecsik ","To":"netfilter-devel@vger.kernel.org","Cc":"Pablo Neira Ayuso ","Subject":"[PATCH v6 1/8] netfilter: ipset: fix a potential dump-destroy race","Date":"Fri, 8 May 2026 22:58:56 +0200","Message-Id":"<20260508205903.10238-2-kadlec@netfilter.org>","X-Mailer":"git-send-email 2.39.5","In-Reply-To":"<20260508205903.10238-1-kadlec@netfilter.org>","References":"<20260508205903.10238-1-kadlec@netfilter.org>","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","X-deepspam":"maybeham 2%","Content-Transfer-Encoding":"quoted-printable"},"content":"When dumping sets in order to create the proper order for restore,\nthe list type of sets dumped last. Therefore internally we run the\ndumping loop twice: first with all non-list type of sets and skipping\nthe list type ones and then secondly for the list type of sets.\n\nSashiko noticed that there's a potential race between dump and destroy\nif in the first loop the last set was a list type of set: its pointer\nremains unreferenced and a concurrent destroy can free it.\n\nFix the issue by resetting the variable holding the pointer.\n\nSigned-off-by: Jozsef Kadlecsik \n---\n net/netfilter/ipset/ip_set_core.c | 1 +\n 1 file changed, 1 insertion(+)","diff":"diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c\nindex c5a26236a0bb..0874029cb0f2 100644\n--- a/net/netfilter/ipset/ip_set_core.c\n+++ b/net/netfilter/ipset/ip_set_core.c\n@@ -1613,6 +1613,7 @@ ip_set_dump_do(struct sk_buff *skb, struct netlink_callback *cb)\n \t\t ((dump_type == DUMP_ALL) ==\n \t\t !!(set->type->features & IPSET_DUMP_LAST))) {\n \t\t\twrite_unlock_bh(&ip_set_ref_lock);\n+\t\t\tset = NULL;\n \t\t\tcontinue;\n \t\t}\n \t\tpr_debug(\"List set: %s\\n\", set->name);\n","prefixes":["v6","1/8"]}