diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-01-12 23:28:45 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-01-25 15:45:14 -0800 |
| commit | 7e0f5f8ae3e5f17e367f7040ade7a467f1f0e3b9 (patch) | |
| tree | 0faaa7c7022f7ccf27257125a22fbfc45995421f /net | |
| parent | ca3ede3f5893e2d26d4dbdef1eec28a8487fafde (diff) | |
| download | linux-stable-7e0f5f8ae3e5f17e367f7040ade7a467f1f0e3b9.tar.gz linux-stable-7e0f5f8ae3e5f17e367f7040ade7a467f1f0e3b9.tar.bz2 linux-stable-7e0f5f8ae3e5f17e367f7040ade7a467f1f0e3b9.zip | |
netfilter: nf_tables: check if catch-all set element is active in next generation
commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7 upstream.
When deactivating the catch-all set element, check the state in the next
generation that represents this transaction.
This bug uncovered after the recent removal of the element busy mark
a2dd0233cbc4 ("netfilter: nf_tables: remove busy mark and gc batch API").
Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support")
Cc: stable@vger.kernel.org
Reported-by: lonial con <kongln9170@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nf_tables_api.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index d5f76e26ae03..5e7994898c76 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -6487,7 +6487,7 @@ static int nft_setelem_catchall_deactivate(const struct net *net, list_for_each_entry(catchall, &set->catchall_list, list) { ext = nft_set_elem_ext(set, catchall->elem); - if (!nft_is_active(net, ext)) + if (!nft_is_active_next(net, ext)) continue; kfree(elem->priv); |