diff options
| author | Alexander Maltsev <keltar.gw@gmail.com> | 2024-04-17 18:51:41 +0500 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-05-20 20:38:42 +0200 |
| commit | c1193d9bbbd379defe9be3c6de566de684de8a6f (patch) | |
| tree | 866614c3deaf88fceeb2e1a2d571080cc5dd1f09 /net/netfilter | |
| parent | dc21c6cc3d6986d938efbf95de62473982c98dec (diff) | |
| download | linux-stable-c1193d9bbbd379defe9be3c6de566de684de8a6f.tar.gz linux-stable-c1193d9bbbd379defe9be3c6de566de684de8a6f.tar.bz2 linux-stable-c1193d9bbbd379defe9be3c6de566de684de8a6f.zip | |
netfilter: ipset: Add list flush to cancel_gc
Flushing list in cancel_gc drops references to other lists right away,
without waiting for RCU to destroy list. Fixes race when referenced
ipsets can't be destroyed while referring list is scheduled for destroy.
Fixes: 97f7cf1cd80e ("netfilter: ipset: fix performance regression in swap operation")
Signed-off-by: Alexander Maltsev <keltar.gw@gmail.com>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/ipset/ip_set_list_set.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c index 6c3f28bc59b3..54e2a1dd7f5f 100644 --- a/net/netfilter/ipset/ip_set_list_set.c +++ b/net/netfilter/ipset/ip_set_list_set.c @@ -549,6 +549,9 @@ list_set_cancel_gc(struct ip_set *set) if (SET_WITH_TIMEOUT(set)) timer_shutdown_sync(&map->gc); + + /* Flush list to drop references to other ipsets */ + list_set_flush(set); } static const struct ip_set_type_variant set_variant = { |