Pablo Neira Ayuso 23a6919bb3 netfilter: nft_set_hash: skip duplicated elements pending gc run ... [ Upstream commit 7ffc748115 ] rhashtable does not provide stable walk, duplicated elements are possible in case of resizing. I considered that checking for errors when calling rhashtable_walk_next() was sufficient to detect the resizing. However, rhashtable_walk_next() returns -EAGAIN only at the end of the iteration, which is too late, because a gc work containing duplicated elements could have been already scheduled for removal to the worker. Add a u32 gc worker sequence number per set, bump it on every workqueue run. Annotate gc worker sequence number on the expired element. Use it to skip those already seen in this gc workqueue run. Note that this new field is never reset in case gc transaction fails, so next gc worker run on the expired element overrides it. Wraparound of gc worker sequence number should not be an issue with stale gc worker sequence number in the element, that would just postpone the element removal in one gc run. Note that it is not possible to use flags to annotate that element is pending gc run to detect duplicates, given that gc transaction can be invalidated in case of update from the control plane, therefore, not allowing to clear such flag. On x86_64, pahole reports no changes in the size of nft_rhash_elem. Fixes: f6c383b8c3 ("netfilter: nf_tables: adapt set backend to use GC transaction API") Reported-by: Laurent Fasnacht <laurent.fasnacht@proton.ch> Tested-by: Laurent Fasnacht <laurent.fasnacht@proton.ch> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-12-14 19:54:23 +01:00
..
6lowpan	net: 6lowpan: constify lowpan_nhc structures	2022-06-09 21:53:28 +02:00
9p	9p/xen: fix release of IRQ	2024-12-14 19:54:08 +01:00
802	mrp: introduce active flags to prevent UAF when applicant uninit	2022-12-31 13:33:02 +01:00
8021q	vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING	2024-01-31 16:17:04 -08:00
appletalk	appletalk: Fix Use-After-Free in atalk_ioctl	2023-12-20 17:00:19 +01:00
atm	atm: Fix Use-After-Free in do_vcc_ioctl	2023-12-20 17:00:17 +01:00
ax25	ax25: Replace kfree() in ax25_dev_free() with ax25_dev_put()	2024-06-21 14:35:32 +02:00
batman-adv	batman-adv: Don't accept TT entries for out-of-spec VIDs	2024-07-05 09:31:58 +02:00
bluetooth	Bluetooth: Fix type of len in rfcomm_sock_getsockopt{,_old}()	2024-12-14 19:54:00 +01:00
bpf	bpf: Set run context for rawtp test_run callback	2024-06-21 14:35:33 +02:00
bpfilter	uaccess: remove CONFIG_SET_FS	2022-02-25 09:36:06 +01:00
bridge	netfilter: br_netfilter: fix panic with metadata_dst skb	2024-10-17 15:22:19 +02:00
caif	net: caif: Fix use-after-free in cfusbl_device_notify()	2023-03-17 08:50:24 +01:00
can	can: j1939: j1939_session_new(): fix skb reference counting	2024-12-14 19:54:21 +01:00
ceph	libceph: fix race between delayed_work() and ceph_monc_stop()	2024-07-18 13:18:41 +02:00
core	bpf: fix recursive lock when verdict program return SK_PASS	2024-12-14 19:53:34 +01:00
dcb	net: dcb: choose correct policy to parse DCB_ATTR_BCN	2023-08-11 12:08:17 +02:00
dccp	dccp: Fix memory leak in dccp_feat_change_recv	2024-12-14 19:54:22 +01:00
devlink	devlink: bump the instance index directly when iterating	2024-10-22 15:56:43 +02:00
dns_resolver	keys, dns: Fix size check of V1 server-list header	2024-01-25 15:27:38 -08:00
dsa	net: mscc: ocelot: use ocelot_xmit_get_vlan_info() also for FDMA and register injection	2024-08-29 17:30:43 +02:00
ethernet	ethernet: Add helper for assigning packet type when dest address does not match device address	2024-05-02 16:29:29 +02:00
ethtool	ethtool: check device is present when getting link settings	2024-09-04 13:25:01 +02:00
hsr	net: hsr: avoid potential out-of-bound access in fill_frame_info()	2024-12-14 19:54:21 +01:00
ieee802154	net: ieee802154: fix error return code in dgram_bind()	2022-10-07 09:29:17 +02:00
ife	net: sched: ife: fix potential use-after-free	2024-01-01 12:38:56 +00:00
ipv4	net-timestamp: make sk_tskey more predictable in error path	2024-12-14 19:54:21 +01:00
ipv6	net/ipv6: release expired exception dst cached in socket	2024-12-14 19:54:21 +01:00
iucv	s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()	2024-12-14 19:53:50 +01:00
kcm	kcm: Serialise kcm_sendmsg() for the same socket.	2024-08-29 17:30:44 +02:00
key	net: af_key: fix sadb_x_filter validation	2023-08-23 17:52:32 +02:00
l2tp	genetlink: hold RCU in genlmsg_mcast()	2024-11-01 01:56:00 +01:00
l3mdev	l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu	2022-04-15 14:27:24 -07:00
lapb
llc	llc: Improve setsockopt() handling of malformed user input	2024-12-14 19:53:51 +01:00
mac80211	mac80211: fix user-power when emulating chanctx	2024-12-14 19:53:08 +01:00
mac802154	net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()	2024-07-25 09:49:17 +02:00
mctp	mctp: Handle error of rtnl_register_module().	2024-10-17 15:22:23 +02:00
mpls	net: mpls: error out if inner headers are not set	2024-04-13 13:05:27 +02:00
mptcp	mptcp: fix possible integer overflow in mptcp_reset_tout_timer	2024-12-14 19:53:13 +01:00
ncsi	net/ncsi: Fix the multi thread manner of NCSI driver	2024-06-21 14:35:33 +02:00
netfilter	netfilter: nft_set_hash: skip duplicated elements pending gc run	2024-12-14 19:54:23 +01:00
netlabel	calipso: fix memory leak in netlbl_calipso_add_pass()	2024-01-25 15:27:20 -08:00
netlink	sock_diag: add module pointer to "struct sock_diag_handler"	2024-12-14 19:53:32 +01:00
netrom	netrom: Fix a memory leak in nr_heartbeat_expiry()	2024-06-27 13:46:18 +02:00
nfc	nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies	2024-11-22 15:37:33 +01:00
nsh	nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().	2024-05-17 11:55:59 +02:00
openvswitch	openvswitch: Set the skbuff pkt_type for proper pmtud support.	2024-06-12 11:03:51 +02:00
packet	sock_diag: add module pointer to "struct sock_diag_handler"	2024-12-14 19:53:32 +01:00
phonet	phonet: fix rtm_phonet_notify() skb allocation	2024-05-17 11:56:12 +02:00
psample	psample: Require 'CAP_NET_ADMIN' when joining "packets" group	2023-12-13 18:39:11 +01:00
qrtr	net: qrtr: Update packets cloning when broadcasting	2024-10-17 15:21:13 +02:00
rds	net:rds: Fix possible deadlock in rds_message_put	2024-08-29 17:30:20 +02:00
rfkill	net: rfkill: gpio: Add check for clk_enable()	2024-12-14 19:53:33 +01:00
rose	net/rose: fix races in rose_kill_by_device()	2024-01-01 12:38:57 +00:00
rxrpc	rxrpc: Improve setsockopt() handling of malformed user input	2024-12-14 19:53:52 +01:00
sched	net: sched: fix erspan_opt settings in cls_flower	2024-12-14 19:54:23 +01:00
sctp	sctp: properly validate chunk size in sctp_sf_ootb()	2024-11-14 13:15:11 +01:00
smc	net/smc: fix LGR and link use-after-free issue	2024-12-14 19:54:22 +01:00
strparser	strparser: pad sk_skb_cb to avoid straddling cachelines	2022-07-08 18:38:44 -07:00
sunrpc	sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport	2024-12-14 19:54:09 +01:00
switchdev	net: bridge: switchdev: Skip MDB replays of deferred events on offload	2024-03-01 13:26:35 +01:00
tipc	tipc: Fix use-after-free of kernel socket in cleanup_bearer().	2024-12-14 19:54:22 +01:00
tls	tls: fix missing memory barrier in tls_init	2024-06-12 11:03:53 +02:00
unix	sock_diag: add module pointer to "struct sock_diag_handler"	2024-12-14 19:53:32 +01:00
vmw_vsock	sock_diag: add module pointer to "struct sock_diag_handler"	2024-12-14 19:53:32 +01:00
wireless	wifi: cfg80211: clear wdev->cqm_config pointer on free	2024-11-08 16:26:45 +01:00
x25	net/x25: fix incorrect parameter validation in the x25_getsockopt() function	2024-03-26 18:20:42 -04:00
xdp	sock_diag: add module pointer to "struct sock_diag_handler"	2024-12-14 19:53:32 +01:00
xfrm	xfrm: validate new SA's prefixlen using SA family when sel.family is unset	2024-11-01 01:56:07 +01:00
compat.c	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
devres.c
Kconfig	Remove DECnet support from kernel	2022-08-22 14:26:30 +01:00
Kconfig.debug	net: make NET_(DEV|NS)_REFCNT_TRACKER depend on NET	2022-09-20 14:23:56 -07:00
Makefile	devlink: move code to a dedicated directory	2023-08-30 16:11:00 +02:00
socket.c	net: explicitly clear the sk pointer, when pf->create fails	2024-10-17 15:22:27 +02:00
sysctl_net.c	sysctl: treewide: drop unused argument ctl_table_root::set_ownership(table)	2024-08-11 12:35:51 +02:00