netfilter: ipset: fix list type element drift bug

If list_set_uadd() calls list_set_replace() to swap an expired entry,
the element count remains the same, therefore the increment must be elided.

Fixes: 702b71e7c666 ("netfilter: ipset: Add element count to all set types header")
Link: https://sashiko.dev/#/patchset/20260806101947.2802-1-fw%40strlen.de
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index ca3ef9479e838d80e714d0d46f1f73ac83c42462..0bc2370773af3c233a39849acbe19fe75660d2d4 100644 (file)
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -301,9 +301,12 @@ list_set_uadd(struct ip_set *set, void *value, const struct ip_set_ext *ext,
        e->set = set;
        INIT_LIST_HEAD(&e->list);
        list_set_init_extensions(set, ext, e);
-       if (n)
+       if (n) {
                list_set_replace(set, e, n);
-       else if (next)
+               return 0;
+       }
+
+       if (next)
                list_add_tail_rcu(&e->list, &next->list);
        else if (prev)
                list_add_rcu(&e->list, &prev->list);