netfilter: ipset: Add list flush to cancel_gc

Flushing list in cancel_gc drops references to other lists right away,
without waiting for RCU to destroy list. Fixes race when referenced
ipsets can't be destroyed while referring list is scheduled for destroy.

Signed-off-by: Alexander Maltsev <keltar.gw@gmail.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>

diff --git a/kernel/net/netfilter/ipset/ip_set_list_set.c b/kernel/net/netfilter/ipset/ip_set_list_set.c
index cc2e5b9be291e69e89aa2e8a4f91e1e15145a10b..0d15f4f00a4f99fab1ec11811d8e99f74e0d66f4 100644 (file)
--- a/kernel/net/netfilter/ipset/ip_set_list_set.c
+++ b/kernel/net/netfilter/ipset/ip_set_list_set.c
@@ -552,6 +552,9 @@ list_set_cancel_gc(struct ip_set *set)
 
        if (SET_WITH_TIMEOUT(set))
                timer_shutdown_sync(&map->gc);
+
+       /* Flush list to drop references to other ipsets */
+       list_set_flush(set);
 }
 
 static const struct ip_set_type_variant set_variant = {