Re: [PATCH] netfilter: nft_set_pipapo: clear dirty flag on abort/commit clone failure

[Florian Westphal <fw@strlen.de>]

Natarajan KV <natarajankv91@gmail.com> wrote:
> nft_pipapo_abort() and nft_pipapo_commit() call pipapo_clone() which
> can fail under memory pressure. When this happens, the functions return

> diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
> index 4274831b6e67..34a108399fd3 100644
> --- a/net/netfilter/nft_set_pipapo.c
> +++ b/net/netfilter/nft_set_pipapo.c
> @@ -1708,8 +1708,10 @@ static void nft_pipapo_commit(struct nft_set *set)
>  		return;
>  
>  	new_clone = pipapo_clone(priv->clone);
> -	if (IS_ERR(new_clone))
> +	if (IS_ERR(new_clone)) {
> +		priv->dirty = false;
>  		return;
> +	}
>  
>  	priv->dirty = false;
>  
> @@ -1743,8 +1745,10 @@ static void nft_pipapo_abort(const struct nft_set *set)
>  	m = rcu_dereference_protected(priv->match, nft_pipapo_transaction_mutex_held(set));
>  
>  	new_clone = pipapo_clone(m);
> -	if (IS_ERR(new_clone))
> +	if (IS_ERR(new_clone)) {
> +		priv->dirty = false;
>  		return;
> +	}

As I said, I don't think this really helps.  Cloning must only happen
in locations where we can still reject the transaction, e.g. during
insert or delete operations.