Commit d111692a authored Oct 17, 2023 by Pablo Neira Ayuso Committed by Florian Westphal Oct 18, 2023

netfilter: nft_set_rbtree: .deactivate fails if element has expired



This allows to remove an expired element which is not possible in other
existing set backends, this is more noticeable if gc-interval is high so
expired elements remain in the tree. On-demand gc also does not help in
this case, because this is delete element path. Return NULL if element
has expired.

Fixes: 8d8540c4 ("netfilter: nft_set_rbtree: add timeout support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>

parent 2e2d9c7d

net/netfilter/nft_set_rbtree.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -568,6 +568,8 @@ static void nft_rbtree_deactivate(const struct net net,
		nft_rbtree_interval_end(this)) {
		parent = parent->rb_right;
		continue;
		} else if (nft_set_elem_expired(&rbe->ext)) {
		break;
		} else if (!nft_set_elem_active(&rbe->ext, genmask)) {
		parent = parent->rb_left;
		continue;