Re: [PATCH 1/1] netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Jun 06, 2024 at 12:24:40AM +0200, Pablo Neira Ayuso wrote:
> Hi Jozsef,
> 
> On Tue, Jun 04, 2024 at 03:58:03PM +0200, Jozsef Kadlecsik wrote:
> [...]
> > @@ -424,14 +428,8 @@ static void
> >  list_set_destroy(struct ip_set *set)
> >  {
> >  	struct list_set *map = set->data;
> > -	struct set_elem *e, *n;
> >  
> > -	list_for_each_entry_safe(e, n, &map->members, list) {
> > -		list_del(&e->list);
> > -		ip_set_put_byindex(map->net, e->id);
> > -		ip_set_ext_destroy(set, e);
> > -		kfree(e);
> > -	}
> > +	BUG_ON(!list_empty(&map->members));
> 
> It would probably be better to turn this is WARN_ON_ONCE, such as:
> 
>         WARN_ON_ONCE(!list_empty(&map->members);
> 
> BUG_ON is only allowed to be used in very particular cases these days.
> 
> I can update this patch if you are fine with it.

Applied to nf.git, I am sorry for the delay, traveling last week.