Commit b1db244f authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_tables: check if catch-all set element is active in next generation 



When deactivating the catch-all set element, check the state in the next
generation that represents this transaction.

This bug uncovered after the recent removal of the element busy mark
a2dd0233 ("netfilter: nf_tables: remove busy mark and gc batch API").

Fixes: aaa31047 ("netfilter: nftables: add catch-all set element support")
Cc: stable@vger.kernel.org
Reported-by: default avatarlonial con <kongln9170@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 98748088

net/netfilter/nf_tables_api.c

+1 −1
Original line number Diff line number Diff line
@@ -6578,7 +6578,7 @@ static int nft_setelem_catchall_deactivate(const struct net *net, 


	list_for_each_entry(catchall, &set->catchall_list, list) {

		ext = nft_set_elem_ext(set, catchall->elem);

		if (!nft_is_active(net, ext))

		if (!nft_is_active_next(net, ext))

			continue;



		kfree(elem->priv);