Commit 27c5a095 authored by Jozsef Kadlecsik's avatar Jozsef Kadlecsik Committed by Pablo Neira Ayuso
Browse files

netfilter: ipset: Missing gc cancellations fixed 



The patch fdb8e12cc2cc ("netfilter: ipset: fix performance regression
in swap operation") missed to add the calls to gc cancellations
at the error path of create operations and at module unload. Also,
because the half of the destroy operations now executed by a
function registered by call_rcu(), neither NFNL_SUBSYS_IPSET mutex
or rcu read lock is held and therefore the checking of them results
false warnings.

Fixes: 97f7cf1c ("netfilter: ipset: fix performance regression in swap operation")
Reported-by: default avatar <syzbot+52bbc0ad036f6f0d4a25@syzkaller.appspotmail.com>
Reported-by: default avatarBrad Spengler <spender@grsecurity.net>
Reported-by: default avatarСтас Ничипорович <stasn77@gmail.com>
Tested-by: default avatarBrad Spengler <spender@grsecurity.net>
Tested-by: default avatarСтас Ничипорович <stasn77@gmail.com>
Signed-off-by: default avatarJozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent ab0beafd

net/netfilter/ipset/ip_set_core.c

+2 −0
Original line number Diff line number Diff line
@@ -1154,6 +1154,7 @@ static int ip_set_create(struct sk_buff *skb, const struct nfnl_info *info, 
	return ret;



cleanup:

	set->variant->cancel_gc(set);

	set->variant->destroy(set);

put_out:

	module_put(set->type->me);
@@ -2378,6 +2379,7 @@ ip_set_net_exit(struct net *net) 
		set = ip_set(inst, i);

		if (set) {

			ip_set(inst, i) = NULL;

			set->variant->cancel_gc(set);

			ip_set_destroy_set(set);

		}

	}

net/netfilter/ipset/ip_set_hash_gen.h

+2 −2
Original line number Diff line number Diff line
@@ -432,7 +432,7 @@ mtype_ahash_destroy(struct ip_set *set, struct htable *t, bool ext_destroy) 
	u32 i;



	for (i = 0; i < jhash_size(t->htable_bits); i++) {

		n = __ipset_dereference(hbucket(t, i));

		n = (__force struct hbucket *)hbucket(t, i);

		if (!n)

			continue;

		if (set->extensions & IPSET_EXT_DESTROY && ext_destroy)
@@ -452,7 +452,7 @@ mtype_destroy(struct ip_set *set) 
	struct htype *h = set->data;

	struct list_head *l, *lt;



	mtype_ahash_destroy(set, ipset_dereference_nfnl(h->table), true);

	mtype_ahash_destroy(set, (__force struct htable *)h->table, true);

	list_for_each_safe(l, lt, &h->ad) {

		list_del(l);

		kfree(l);