diff mbox series

[net,01/10] netfilter: ipset: do not update comments from kernel-side adds

Message ID 20260930074142.298353-2-pablo@netfilter.org
State Accepted
Headers show
Series [net,01/10] netfilter: ipset: do not update comments from kernel-side adds | expand

Commit Message

Pablo Neira Ayuso Sept. 30, 2026, 7:41 a.m. UTC 
From: Florian Westphal <fw@strlen.de>

'Fixes' commit stopped calling ip_set_init_comment() for hash types
from kernel-side-adds (xtables .. -j SET).  ip_set_init_comment() says:

   "The kadt functions don't use the comment extensions in any way."

But bitmap set type calls the function from kadt cb too.

While this appears to be safe (serialized via the set spinlock), it seems
better to not call the init function either, least of all to keep
behaviour consistent.

ip_set_list calls ip_set_init_comment() only from uadt cb, it can be
kept as-is.

This was triggered by yet another LLM review, hinting that the existing
rcu_dereference_protected() cannot be downgraded to only check if the
nfnl mutex is held.

Fixes: f30415929be8 ("netfilter: ipset: do not update comments from kernel-side hash adds")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
 net/netfilter/ipset/ip_set_bitmap_gen.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

patchwork-bot+netdevbpf@kernel.org Oct. 1, 2026, 10:20 a.m. UTC | #1 
Hello:

This series was applied to netdev/net.git (main)
by Pablo Neira Ayuso <pablo@netfilter.org>:

On Wed, 30 Sep 2026 09:41:32 +0200 you wrote:
> From: Florian Westphal <fw@strlen.de>
> 
> 'Fixes' commit stopped calling ip_set_init_comment() for hash types
> from kernel-side-adds (xtables .. -j SET).  ip_set_init_comment() says:
> 
>    "The kadt functions don't use the comment extensions in any way."
> 
> [...]

Here is the summary with links:
  - [net,01/10] netfilter: ipset: do not update comments from kernel-side adds
    https://git.kernel.org/netdev/net/c/a442c8a89fb9
  - [net,02/10] netfilter: nft_flow_offload: drop flowtable reference on init error path
    https://git.kernel.org/netdev/net/c/747928b5d4ff
  - [net,03/10] ipvs: fix missing counter decrement in lblc
    https://git.kernel.org/netdev/net/c/bdac17779f46
  - [net,04/10] ipvs: bound LBLCR and LBLC cache growth
    https://git.kernel.org/netdev/net/c/2a3c3de660f9
  - [net,05/10] ipvs: do not create invisible templates
    https://git.kernel.org/netdev/net/c/616cf5c06934
  - [net,06/10] ipvs: filter some flags received in the backup server
    https://git.kernel.org/netdev/net/c/f96e91748f63
  - [net,07/10] netfilter: nft_set_rbtree: skip transaction elements during GC
    https://git.kernel.org/netdev/net/c/86b6471e690c
  - [net,08/10] netfilter: bpf: reject invalid NAT manipulation types
    https://git.kernel.org/netdev/net/c/16d464013ec2
  - [net,09/10] netfilter: flowtable: generalize pending status bit
    https://git.kernel.org/netdev/net/c/7c549fb7eecd
  - [net,10/10] netfilter: flowtable: restore ieee80211 forward path
    https://git.kernel.org/netdev/net/c/3ae37eafd366

You are awesome, thank you!
diff mbox series

Patch

diff --git a/net/netfilter/ipset/ip_set_bitmap_gen.h b/net/netfilter/ipset/ip_set_bitmap_gen.h
index d6a7e6604542..ae376fa3e7a3 100644
--- a/net/netfilter/ipset/ip_set_bitmap_gen.h
+++ b/net/netfilter/ipset/ip_set_bitmap_gen.h
@@ -159,7 +159,7 @@  mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,
 
 	if (SET_WITH_COUNTER(set))
 		ip_set_init_counter(ext_counter(x, set), ext);
-	if (SET_WITH_COMMENT(set))
+	if (SET_WITH_COMMENT(set) && !ext->target)
 		ip_set_init_comment(set, ext_comment(x, set), ext);
 	if (SET_WITH_SKBINFO(set))
 		ip_set_init_skbinfo(ext_skbinfo(x, set), ext);