{"id":2235204,"url":"http://patchwork.ozlabs.org/api/1.2/patches/2235204/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260508205903.10238-6-kadlec@netfilter.org/","project":{"id":26,"url":"http://patchwork.ozlabs.org/api/1.2/projects/26/?format=json","name":"Netfilter Development","link_name":"netfilter-devel","list_id":"netfilter-devel.vger.kernel.org","list_email":"netfilter-devel@vger.kernel.org","web_url":null,"scm_url":null,"webscm_url":null,"list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20260508205903.10238-6-kadlec@netfilter.org>","list_archive_url":null,"date":"2026-05-08T20:59:00","name":"[v6,5/8] netfilter: ipset: Don't use test_bit() in lockless RCU readers","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"e20d7aeef3bfb448851397bd1225d7c7a110b6af","submitter":{"id":77226,"url":"http://patchwork.ozlabs.org/api/1.2/people/77226/?format=json","name":"Jozsef Kadlecsik","email":"kadlec@netfilter.org"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260508205903.10238-6-kadlec@netfilter.org/mbox/","series":[{"id":503447,"url":"http://patchwork.ozlabs.org/api/1.2/series/503447/?format=json","web_url":"http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=503447","date":"2026-05-08T20:58:57","name":"netfilter: ipset fixes","version":6,"mbox":"http://patchwork.ozlabs.org/series/503447/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2235204/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2235204/checks/","tags":{},"related":[],"headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","netfilter-devel@vger.kernel.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=blackhole.kfki.hu header.i=@blackhole.kfki.hu\n header.a=rsa-sha256 header.s=20151130 header.b=ouZJCw/j;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12514-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)","smtp.subspace.kernel.org;\n\tdkim=pass (1024-bit key) header.d=blackhole.kfki.hu\n header.i=@blackhole.kfki.hu header.b=\"ouZJCw/j\"","smtp.subspace.kernel.org;\n arc=none smtp.client-ip=148.6.0.51","smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org","smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=blackhole.kfki.hu"],"Received":["from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4gC1pn6s8Dz1yK7\n\tfor ; Sat, 09 May 2026 07:05:05 +1000 (AEST)","from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 84AC8304D5D0\n\tfor ; Fri, 8 May 2026 21:04:23 +0000 (UTC)","from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 668F9421A1A;\n\tFri, 8 May 2026 21:04:22 +0000 (UTC)","from smtp-out.kfki.hu (smtp-out.kfki.hu [148.6.0.51])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 3BAAC37D12E\n\tfor ; Fri, 8 May 2026 21:04:19 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n\tby smtp2.kfki.hu (Postfix) with ESMTP id 4gC1gv0PRZz7s861;\n\tFri, 8 May 2026 22:59:07 +0200 (CEST)","from smtp2.kfki.hu ([127.0.0.1])\n by localhost (smtp2.kfki.hu [127.0.0.1]) (amavis, port 10026) with ESMTP\n id sutdcrN1pofD; Fri, 8 May 2026 22:59:05 +0200 (CEST)","from mentat.rmki.kfki.hu (254C131D.nat.pool.telekom.hu\n [37.76.19.29])\n\t(Authenticated sender: kadlecsik.jozsef@wigner.hu)\n\tby smtp2.kfki.hu (Postfix) with ESMTPSA id 4gC1gs14thz7s863;\n\tFri, 8 May 2026 22:59:05 +0200 (CEST)","by mentat.rmki.kfki.hu (Postfix, from userid 1000)\n\tid 00010141EC6; Fri, 8 May 2026 22:59:03 +0200 (CEST)"],"ARC-Seal":"i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1778274262; cv=none;\n b=tf+IOUHR0ogN/85nRvEQBnfN5iUKAZCOcy/EG9yyQdCmk6GUPBojrqhNQWd98liCtlA8gE7v2IlvD0j1LkZSFeew1/hjavpnZdp2d80ZuZQkGI8rV4P4vlziSYjQ1WYA3LC+R9ZWiOsrmBiBm6tPG99QLVGPUvtnVs+KT0wCxlw=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1778274262; c=relaxed/simple;\n\tbh=AqW/trGO+huLsN/1N4JUDSjuHaYa8YmspIEfXEH9TbI=;\n\th=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References:\n\t MIME-Version;\n b=uBbMOsJUyb457W2MJ4W0YKDT7+Ev8yr3gzBOAZWNLiAJXH4qTqAfA1AD0Rqg3cr6DviTdB8qvBNfFuKMyiQqZs253l1S39iZE+/oGn5dPZtmMmItmKOor8dqTMal+Jkonq6VEyWt3mtPA8C1KSEzKlAYMzGlbbkgz7A4aGJC4PQ=","ARC-Authentication-Results":"i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org;\n spf=pass smtp.mailfrom=blackhole.kfki.hu;\n dkim=pass (1024-bit key) header.d=blackhole.kfki.hu\n header.i=@blackhole.kfki.hu header.b=ouZJCw/j;\n arc=none smtp.client-ip=148.6.0.51","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=\n\tblackhole.kfki.hu; h=mime-version:references:in-reply-to\n\t:x-mailer:message-id:date:date:from:from:received:received\n\t:received; s=20151130; t=1778273945; x=1780088346; bh=UjidRbHUaw\n\tfRn67WkJqYQGZx6l6A4xDzJX+SyZ7voXg=; b=ouZJCw/jOMUGoS7uYhxZgXSBca\n\tItrrJTCWxSkQ7MOTA9UDYlbBsvc7FGNQWEd5m7R9vrDA6DQXIY5YiHJ0EJQ04xHk\n\tYjJSHac2vJjO0TalLjPqFgqSJuvj/Cu0dh3DG2nnn1VucI2jnQPBC9eGY9xGofnr\n\tqto2k144tMzCCj2J8=","X-Virus-Scanned":"Debian amavis at smtp2.kfki.hu","From":"Jozsef Kadlecsik ","To":"netfilter-devel@vger.kernel.org","Cc":"Pablo Neira Ayuso ","Subject":"[PATCH v6 5/8] netfilter: ipset: Don't use test_bit() in lockless RCU\n readers","Date":"Fri, 8 May 2026 22:59:00 +0200","Message-Id":"<20260508205903.10238-6-kadlec@netfilter.org>","X-Mailer":"git-send-email 2.39.5","In-Reply-To":"<20260508205903.10238-1-kadlec@netfilter.org>","References":"<20260508205903.10238-1-kadlec@netfilter.org>","Precedence":"bulk","X-Mailing-List":"netfilter-devel@vger.kernel.org","List-Id":"","List-Subscribe":"","List-Unsubscribe":"","MIME-Version":"1.0","X-deepspam":"maybeham 3%","Content-Transfer-Encoding":"quoted-printable"},"content":"Sashiko pointed out that there are a few lockless RCU readers\nusing test_bit() which is a relaxed atomic operation and\nprovides no memory barrier guarantees. Use test_bit_acquire()\ninstead where the operation may run parallel with add/del/gc,\ni.e. is not one from the next cases\n\n- protected by region lock\n- in a set destroy phase\n- in a new/temporary set creation phase\n\nAlso, add two missing smp_mb__after_atomic() operations.\n\nSigned-off-by: Jozsef Kadlecsik \n---\n net/netfilter/ipset/ip_set_hash_gen.h | 11 ++++++-----\n 1 file changed, 6 insertions(+), 5 deletions(-)","diff":"diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h\nindex 04e4627ddfc1..6a31f2db824a 100644\n--- a/net/netfilter/ipset/ip_set_hash_gen.h\n+++ b/net/netfilter/ipset/ip_set_hash_gen.h\n@@ -689,7 +689,7 @@ mtype_resize(struct ip_set *set, bool retried)\n \t\t\t\tcontinue;\n \t\t\tpos = smp_load_acquire(&n->pos);\n \t\t\tfor (j = 0; j < pos; j++) {\n-\t\t\t\tif (!test_bit(j, n->used))\n+\t\t\t\tif (!test_bit_acquire(j, n->used))\n \t\t\t\t\tcontinue;\n \t\t\t\tdata = ahash_data(n, j, dsize);\n \t\t\t\tif (SET_ELEM_EXPIRED(set, data))\n@@ -826,7 +826,7 @@ mtype_ext_size(struct ip_set *set, u32 *elements, size_t *ext_size)\n \t\t\t\tcontinue;\n \t\t\tpos = smp_load_acquire(&n->pos);\n \t\t\tfor (j = 0; j < pos; j++) {\n-\t\t\t\tif (!test_bit(j, n->used))\n+\t\t\t\tif (!test_bit_acquire(j, n->used))\n \t\t\t\t\tcontinue;\n \t\t\t\tdata = ahash_data(n, j, set->dsize);\n \t\t\t\tif (!SET_ELEM_EXPIRED(set, data))\n@@ -995,6 +995,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,\n \t/* Ensure all data writes are visible before updating position */\n \tsmp_store_release(&n->pos, npos);\n \tset_bit(j, n->used);\n+\tsmp_mb__after_atomic();\n \tif (old != ERR_PTR(-ENOENT)) {\n \t\trcu_assign_pointer(hbucket(t, key), n);\n \t\tif (old)\n@@ -1201,7 +1202,7 @@ mtype_test_cidrs(struct ip_set *set, struct mtype_elem *d,\n \t\t\tcontinue;\n \t\tpos = smp_load_acquire(&n->pos);\n \t\tfor (i = 0; i < pos; i++) {\n-\t\t\tif (!test_bit(i, n->used))\n+\t\t\tif (!test_bit_acquire(i, n->used))\n \t\t\t\tcontinue;\n \t\t\tdata = ahash_data(n, i, set->dsize);\n \t\t\tif (!mtype_data_equal(data, d, &multi))\n@@ -1259,7 +1260,7 @@ mtype_test(struct ip_set *set, void *value, const struct ip_set_ext *ext,\n \t}\n \tpos = smp_load_acquire(&n->pos);\n \tfor (i = 0; i < pos; i++) {\n-\t\tif (!test_bit(i, n->used))\n+\t\tif (!test_bit_acquire(i, n->used))\n \t\t\tcontinue;\n \t\tdata = ahash_data(n, i, set->dsize);\n \t\tif (!mtype_data_equal(data, d, &multi))\n@@ -1396,7 +1397,7 @@ mtype_list(const struct ip_set *set,\n \t\t\tcontinue;\n \t\tpos = smp_load_acquire(&n->pos);\n \t\tfor (i = 0; i < pos; i++) {\n-\t\t\tif (!test_bit(i, n->used))\n+\t\t\tif (!test_bit_acquire(i, n->used))\n \t\t\t\tcontinue;\n \t\t\te = ahash_data(n, i, set->dsize);\n \t\t\tif (SET_ELEM_EXPIRED(set, e))\n","prefixes":["v6","5/8"]}