Commit c1193d9b authored by Alexander Maltsev's avatar Alexander Maltsev Committed by Pablo Neira Ayuso
Browse files

netfilter: ipset: Add list flush to cancel_gc 



Flushing list in cancel_gc drops references to other lists right away,
without waiting for RCU to destroy list. Fixes race when referenced
ipsets can't be destroyed while referring list is scheduled for destroy.

Fixes: 97f7cf1c ("netfilter: ipset: fix performance regression in swap operation")
Signed-off-by: default avatarAlexander Maltsev <keltar.gw@gmail.com>
Acked-by: default avatarJozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent dc21c6cc

net/netfilter/ipset/ip_set_list_set.c

+3 −0
Original line number Diff line number Diff line
@@ -549,6 +549,9 @@ list_set_cancel_gc(struct ip_set *set) 


	if (SET_WITH_TIMEOUT(set))

		timer_shutdown_sync(&map->gc);



	/* Flush list to drop references to other ipsets */

	list_set_flush(set);

}



static const struct ip_set_type_variant set_variant = {