From f217b98c72703a08e34a67ef876c60fb5d584091 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 11 Dec 2023 14:39:42 +0100 Subject: [PATCH] 5.10-stable patches added patches: netfilter-nft_set_pipapo-skip-inactive-elements-during-set-walk.patch --- ...ip-inactive-elements-during-set-walk.patch | 32 +++++++++++++++++++ queue-5.10/series | 1 + 2 files changed, 33 insertions(+) create mode 100644 queue-5.10/netfilter-nft_set_pipapo-skip-inactive-elements-during-set-walk.patch diff --git a/queue-5.10/netfilter-nft_set_pipapo-skip-inactive-elements-during-set-walk.patch b/queue-5.10/netfilter-nft_set_pipapo-skip-inactive-elements-during-set-walk.patch new file mode 100644 index 00000000000..75665710339 --- /dev/null +++ b/queue-5.10/netfilter-nft_set_pipapo-skip-inactive-elements-during-set-walk.patch @@ -0,0 +1,32 @@ +From 317eb9685095678f2c9f5a8189de698c5354316a Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Fri, 1 Dec 2023 15:47:13 +0100 +Subject: netfilter: nft_set_pipapo: skip inactive elements during set walk + +From: Florian Westphal + +commit 317eb9685095678f2c9f5a8189de698c5354316a upstream. + +Otherwise set elements can be deactivated twice which will cause a crash. + +Reported-by: Xingyuan Mo +Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nft_set_pipapo.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/netfilter/nft_set_pipapo.c ++++ b/net/netfilter/nft_set_pipapo.c +@@ -2028,6 +2028,9 @@ static void nft_pipapo_walk(const struct + + e = f->mt[r].e; + ++ if (!nft_set_elem_active(&e->ext, iter->genmask)) ++ goto cont; ++ + elem.priv = e; + + iter->err = iter->fn(ctx, set, iter, &elem); diff --git a/queue-5.10/series b/queue-5.10/series index c08540bfb3d..bc198241c11 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -84,3 +84,4 @@ netlink-don-t-call-netlink_bind-with-table-lock-held.patch genetlink-add-cap_net_admin-test-for-multicast-bind.patch psample-require-cap_net_admin-when-joining-packets-group.patch drop_monitor-require-cap_sys_admin-when-joining-events-group.patch +netfilter-nft_set_pipapo-skip-inactive-elements-during-set-walk.patch -- 2.47.3