From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH nf] netfilter: revert nft_set_rbtree: validate open interval overlap
Date: Wed, 11 Mar 2026 17:11:08 +0100 [thread overview]
Message-ID: <abGUHMhlXQDdVr2V@chamomile> (raw)
In-Reply-To: <20260311152916.17696-1-fw@strlen.de>
On Wed, Mar 11, 2026 at 04:29:12PM +0100, Florian Westphal wrote:
> This reverts commit 648946966a08 ("netfilter: nft_set_rbtree: validate
> open interval overlap").
>
> There have been reports of nft failing to laod valid rulesets after this
> patch was merged into -stable.
>
> I can reproduce several such problem with recent nft versions, including
> nft 1.1.6 which is widely shipped by distributions.
The culprit is this bug in userspace:
e83e32c8d1cd mnl: restore create element command with large batches
At the same time, 1.1.6 is broken because of this bug _regardless_
this patch.
> We currently have little choice here.
> This commit can be resurrected at some point once the nftables fix that
> triggers the false overlap positive has appeared in common distros
> (see e83e32c8d1cd ("mnl: restore create element command with large batches" in
> nftables.git).
Yes, we can just wait for the userspace fix to propagate, then merge
this in again.
It is very unfortunate that this userspace bug in the way.
> Fixes: 648946966a08 ("netfilter: nft_set_rbtree: validate open interval overlap")
> Signed-off-by: Florian Westphal <fw@strlen.de>
>
> ---
> Pablo, if you prefer a different approach, e.g. just axing
> the relevant check instead of full revert please let me know.
I can think of workaround such as adding a temporary sysctl knob
to disable this... but it is ugly.
Probably it is more sensible to revert temporarily and wait for a bit
of time for the e83e32c8d1cd userspace bugfix to propagate downstream.
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
prev parent reply other threads:[~2026-03-11 16:11 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-11 15:29 [PATCH nf] netfilter: revert nft_set_rbtree: validate open interval overlap Florian Westphal
2026-03-11 16:11 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=abGUHMhlXQDdVr2V@chamomile \
--to=pablo@netfilter.org \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.