[PATCH nf] netfilter: ipset: restore element before rescanning cidrs on seqcount retry

[Tamaki Yanagawa <ty@000ty.net>]

mtype_test_cidrs() masks the element under test in place with
mtype_data_netmask() while walking the cidr array from the most to the
least specific prefix. Since the walk is restarted on concurrent cidr
array updates, the IPSET_NET_COUNT == 1 types (hash:net, hash:net,port,
hash:ip,port,net, hash:net,iface) rescan with an element already masked
to the widest prefix tried, so a lookup can wrongly match a more specific
entry at the network base address (e.g. 10.200.3.4 matching 10.0.0.0/29).
Restore the element before rescanning.

Fixes: e80456d79ec8 ("netfilter: ipset: remove need to allocate memory on delete operations")
Signed-off-by: Tamaki Yanagawa <ty@000ty.net>
Assisted-by: Claude:claude-opus-5-5
---
 net/netfilter/ipset/ip_set_hash_gen.h | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 80ca523f30..4f94443dcd 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -1307,9 +1307,9 @@ mtype_test_cidrs(struct ip_set *set, struct mtype_elem *d,
 	struct net_prefixes *nets0;
 	struct hbucket *n;
 	struct mtype_elem *data;
+	struct mtype_elem orig = *d;
 #if IPSET_NET_COUNT == 2
 	struct net_prefixes *nets1;
-	struct mtype_elem orig = *d;
 	unsigned int seq1;
 	int ret, i, j, k;
 #else
@@ -1372,13 +1372,17 @@ mtype_test_cidrs(struct ip_set *set, struct mtype_elem *d,
 	ret = 0;
 unlock:
 	if (read_seqcount_retry(&nets0->seq, seq0))
-		goto retry;
+		goto restore;
 #if IPSET_NET_COUNT == 2
 	if (read_seqcount_retry(&nets1->seq, seq1))
-		goto retry;
+		goto restore;
 #endif
 	rcu_read_unlock_bh();
 	return ret;
+restore:
+	/* mtype_data_netmask() masks @d in place, undo it before rescanning */
+	*d = orig;
+	goto retry;
 }
 #endif
 

base-commit: ab699d296e066eb64f51d2a8a1d42237a3b186c8
-- 
2.52.0.windows.1