diff mbox series

[v7,09/10] netfilter: ipset: fix potential torn read in reuse/forceadd cases

Message ID 20260514085519.12729-10-kadlec@netfilter.org
State Changes Requested, archived
Headers show
Series netfilter: ipset fixes | expand

Commit Message

Jozsef Kadlecsik May 14, 2026, 8:55 a.m. UTC 
Sashiko pointed out that due to using memcpy() to overwrite
already existing entry in reuse/forceadd cases, it can lead to
torn reads for concurrent lockless RCU readers. Set the element
explicitly to unused before reusing it.

Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
---
 net/netfilter/ipset/ip_set_hash_gen.h | 6 ++++++
 1 file changed, 6 insertions(+)
diff mbox series

Patch

diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index ba560ebb4719..9d1fcf6c8328 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -933,6 +933,12 @@  mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
 			j = 0;
 		data = ahash_data(n, j, set->dsize);
 		if (!deleted) {
+			clear_bit(j, n->used);
+			/* Give time to other readers of the set
+			 * to avoid torn reads due to the memcpy()
+			 * below.
+			 */
+			synchronize_rcu();
 #ifdef IP_SET_HASH_WITH_NETS
 			for (i = 0; i < IPSET_NET_COUNT; i++)
 				mtype_del_cidr(set, h,