From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3306537524F for ; Sat, 28 Feb 2026 18:16:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772302572; cv=none; b=XtODWlKbQpvDwxXT2udIHX5KmSLfYP7UbO5zhPLFQ7kQj88A8GSU65RCg/hufkubVA1ReYivZOD+FRF2kP3+/MHvrFXtRLJcIlBnwicxq+6XsQFOxM64u9/lY0iRO2ct7Pbnd424rCGTR1KNfOw2/HjMpe03AAGT3MgsiADGlYA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772302572; c=relaxed/simple; bh=WAB+gmf9xiZTWg8oMAUVNHdsl9+//3/MbeoH0kcmQ+M=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KmwJy4G6n0g7WS7ZKNODc1zPQ3bXMLJYvNS7ub188c+Prvke4jy53du71OnR8CXiec4CUBBm0Fue+U1/ZAwT/8Cj5Nt+ZJzBouZvIqxR6w+fm3v8rUpbFXzynoQ6jbZAz0v6KaLXGnkpdK/1pq7WTf0NJixjJ7sRTDrEYXb19UI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=IcD99qmo; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="IcD99qmo" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 96930C116D0; Sat, 28 Feb 2026 18:16:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1772302572; bh=WAB+gmf9xiZTWg8oMAUVNHdsl9+//3/MbeoH0kcmQ+M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IcD99qmofhIWchobPaqyqiDLvTzmp7O77dpG1xsIl8l9F6eDqheNRLdp6oO3+h9DY o6mE0Ny3NqHbmV/sr21TAiZRWCS67qs1TGt2mlGJk1J8J5MdSZeam3TKpz2PQq0iwl aVt4oCgS8ZwDkthSt6Vpxsmg8iTjHQE+DeRLCx3ZpXjasDL23/Q8CbdBZK2F0sD9uV j6nFTnWA3kY1QN+U7yhcYSAbARA1CviUmYT4mJviIiJNQZ0LBqs7jriipZqKBHMEkP u/PmYZPEJiGhqKSLX1mBMTkaJL4deh9M7xaWWfNiCzYxPyOkZm2jLAQZM1EcBYzIt5 g9kSBqLT2JqJQ== From: Sasha Levin To: patches@lists.linux.dev Cc: Pablo Neira Ayuso , Florian Westphal , Sasha Levin Subject: [PATCH 5.15 079/164] netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets Date: Sat, 28 Feb 2026 13:13:38 -0500 Message-ID: <20260228181505.1600663-79-sashal@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260228181505.1600663-1-sashal@kernel.org> References: <20260228181505.1600663-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit From: Pablo Neira Ayuso [ Upstream commit 4780ec142cbb24b794129d3080eee5cac2943ffc ] Userspace provides an optimized representation in case intervals are adjacent, where the end element is omitted. The existing partial overlap detection logic skips anonymous set checks on start elements for this reason. However, it is possible to add intervals that overlap to this anonymous where two start elements with the same, eg. A-B, A-C where C < B. start end A B start end A C Restore the check on overlapping start elements to report an overlap. Fixes: c9e6978e2725 ("netfilter: nft_set_rbtree: Switch to node list walk for overlap detection") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal Signed-off-by: Sasha Levin --- net/netfilter/nft_set_rbtree.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-) diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c index 021d9e76129a5..426becaad1b94 100644 --- a/net/netfilter/nft_set_rbtree.c +++ b/net/netfilter/nft_set_rbtree.c @@ -305,11 +305,23 @@ static bool nft_rbtree_update_first(const struct nft_set *set, return false; } +/* Only for anonymous sets which do not allow updates, all element are active. */ +static struct nft_rbtree_elem *nft_rbtree_prev_active(struct nft_rbtree_elem *rbe) +{ + struct rb_node *node; + + node = rb_prev(&rbe->node); + if (!node) + return NULL; + + return rb_entry(node, struct nft_rbtree_elem, node); +} + static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, struct nft_rbtree_elem *new, struct nft_set_ext **ext) { - struct nft_rbtree_elem *rbe, *rbe_le = NULL, *rbe_ge = NULL; + struct nft_rbtree_elem *rbe, *rbe_le = NULL, *rbe_ge = NULL, *rbe_prev; struct rb_node *node, *next, *parent, **p, *first = NULL; struct nft_rbtree *priv = nft_set_priv(set); u8 cur_genmask = nft_genmask_cur(net); @@ -441,11 +453,19 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, /* - new start element with existing closest, less or equal key value * being a start element: partial overlap, reported as -ENOTEMPTY. * Anonymous sets allow for two consecutive start element since they - * are constant, skip them to avoid bogus overlap reports. + * are constant, but validate that this new start element does not + * sit in between an existing start and end elements: partial overlap, + * reported as -ENOTEMPTY. */ - if (!nft_set_is_anonymous(set) && rbe_le && - nft_rbtree_interval_start(rbe_le) && nft_rbtree_interval_start(new)) - return -ENOTEMPTY; + if (rbe_le && + nft_rbtree_interval_start(rbe_le) && nft_rbtree_interval_start(new)) { + if (!nft_set_is_anonymous(set)) + return -ENOTEMPTY; + + rbe_prev = nft_rbtree_prev_active(rbe_le); + if (rbe_prev && nft_rbtree_interval_end(rbe_prev)) + return -ENOTEMPTY; + } /* - new end element with existing closest, less or equal key value * being a end element: partial overlap, reported as -ENOTEMPTY. -- 2.51.0