summaryrefslogtreecommitdiffstats
path: root/net/netfilter/nft_set_pipapo.c
diff options
context:
space:
mode:
authorPaolo Abeni <pabeni@redhat.com>2024-04-18 13:12:36 +0200
committerPaolo Abeni <pabeni@redhat.com>2024-04-18 13:12:37 +0200
commitac1a21db32eda8a09076bad025d7b848dd086d28 (patch)
tree0b5d86138ccb91b73e20d24a196f3469809c42fe /net/netfilter/nft_set_pipapo.c
parentd10a7f551ecee6885095fc96aabcfbf959d4a256 (diff)
parent86a1471d7cde792941109b93b558b5dc078b9ee9 (diff)
downloadlinux-ac1a21db32eda8a09076bad025d7b848dd086d28.tar.gz
linux-ac1a21db32eda8a09076bad025d7b848dd086d28.tar.bz2
linux-ac1a21db32eda8a09076bad025d7b848dd086d28.zip
Merge tag 'nf-24-04-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: Patch #1 amends a missing spot where the set iterator type is unset. This is fixing a issue in the previous pull request. Patch #2 fixes the delete set command abort path by restoring state of the elements. Reverse logic for the activate (abort) case otherwise element state is not restored, this requires to move the check for active/inactive elements to the set iterator callback. From the deactivate path, toggle the next generation bit and from the activate (abort) path, clear the next generation bitmask. Patch #3 skips elements already restored by delete set command from the abort path in case there is a previous delete element command in the batch. Check for the next generation bit just like it is done via set iteration to restore maps. netfilter pull request 24-04-18 * tag 'nf-24-04-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: fix memleak in map from abort path netfilter: nf_tables: restore set elements when delete set fails netfilter: nf_tables: missing iterator type in lookup walk ==================== Link: https://lore.kernel.org/r/20240418010948.3332346-1-pablo@netfilter.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'net/netfilter/nft_set_pipapo.c')
-rw-r--r--net/netfilter/nft_set_pipapo.c8
1 files changed, 3 insertions, 5 deletions
diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
index eeaf05ffba95..187138afac45 100644
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -1847,7 +1847,7 @@ static void nft_pipapo_activate(const struct net *net,
{
struct nft_pipapo_elem *e = nft_elem_priv_cast(elem_priv);
- nft_set_elem_change_active(net, set, &e->ext);
+ nft_clear(net, &e->ext);
}
/**
@@ -2123,7 +2123,8 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set,
const struct nft_pipapo_field *f;
unsigned int i, r;
- WARN_ON_ONCE(iter->type == NFT_ITER_UNSPEC);
+ WARN_ON_ONCE(iter->type != NFT_ITER_READ &&
+ iter->type != NFT_ITER_UPDATE);
rcu_read_lock();
if (iter->type == NFT_ITER_READ)
@@ -2148,9 +2149,6 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set,
e = f->mt[r].e;
- if (!nft_set_elem_active(&e->ext, iter->genmask))
- goto cont;
-
iter->err = iter->fn(ctx, set, iter, &e->priv);
if (iter->err < 0)
goto out;