Re: [PATCH net 04/11] netfilter: revert nft_set_rbtree: validate open interval overlap: manual merge

Re: [PATCH net 04/11] netfilter: revert nft_set_rbtree: validate open interval overlap: manual merge

[Matthieu Baerts]

Hi Florian,

(+cc linux-next)

On 13/03/2026 16:06, Florian Westphal wrote:
> This reverts commit 648946966a08 ("netfilter: nft_set_rbtree: validate
> open interval overlap").
> 
> There have been reports of nft failing to laod valid rulesets after this
> patch was merged into -stable.
> 
> I can reproduce several such problem with recent nft versions, including
> nft 1.1.6 which is widely shipped by distributions.
> 
> We currently have little choice here.
> This commit can be resurrected at some point once the nftables fix that
> triggers the false overlap positive has appeared in common distros
> (see e83e32c8d1cd ("mnl: restore create element command with large batches" in
>  nftables.git).

FYI, we got a small conflict when merging 'net' in 'net-next' in the
MPTCP tree due to this patch applied in 'net':

  598adea720b9 ("netfilter: revert nft_set_rbtree: validate open interval overlap")

and this one from 'net-next':

  3aea466a4399 ("netfilter: nft_set_rbtree: don't disable bh when acquiring tree lock")

(...)

> diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
> index ee3d4f5b9ff7..fe8bd497d74a 100644
> --- a/net/netfilter/nft_set_rbtree.c
> +++ b/net/netfilter/nft_set_rbtree.c

(...)

> @@ -685,12 +640,8 @@ static int nft_rbtree_insert(const struct net *net, const struct nft_set *set,
>  		cond_resched();
>  
>  		write_lock_bh(&priv->lock);
> -		err = __nft_rbtree_insert(net, set, rbe, elem_priv, tstamp, last);
> +		err = __nft_rbtree_insert(net, set, rbe, elem_priv, tstamp);
>  		write_unlock_bh(&priv->lock);

The conflict was in the context: the patch in "net-next" stop disabling
bh, modifying the two write_(un)lock_bh() calls, while here the code
executed with the lock and just after is modified.

Rerere cache is available in [1]. The patch is attached below.

Cheers,
Matt

1: https://github.com/multipath-tcp/mptcp-upstream-rr-cache/commit/a0ec8d0

-------------------- 8< --------------------
diff --cc net/netfilter/nft_set_rbtree.c
index e42905376654,fe8bd497d74a..b7501b2b873e
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@@ -684,13 -639,9 +639,9 @@@ static int nft_rbtree_insert(const stru
  
  		cond_resched();
  
 -		write_lock_bh(&priv->lock);
 +		write_lock(&priv->lock);
- 		err = __nft_rbtree_insert(net, set, rbe, elem_priv, tstamp, last);
+ 		err = __nft_rbtree_insert(net, set, rbe, elem_priv, tstamp);
 -		write_unlock_bh(&priv->lock);
 +		write_unlock(&priv->lock);
- 
- 		if (nft_rbtree_interval_end(rbe))
- 			priv->start_rbe_cookie = 0;
- 
  	} while (err == -EAGAIN);
  
  	return err;
-------------------- 8< --------------------

-- 
Sponsored by the NGI0 Core fund.