From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793212462; b=UwmYjSbOlW4qAZWCM2MoMBo0AsVeriTtouh+zarRZ84/PavB7PsvEvnMNcAYjGoKgskA 8qVJ4sm+cZiH+yoEkDz2TMdHJ3Bf5MJxPkQ7T5fDBzo8Fy203tLzgeYRr1QZRQzcAFlxp JTxVyxzWEL1u5MgUyENMyDrIYJ9W2l9WCv13Gw8ZtbE4wpGMTl66sZHJ1gyMFuJzhrGl+ C99Aprne0QC7mAmy3o+XuwLlpkWlmbVqUXFInAZ3XlB9T2D9VTJDn3czTNDJXN2vHdTLi uFieACEJnLuEZwspJNERawxXJZDwogA5zyzFBEaqekO6eKT80munFAyaj2pk7e8+koQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793212462; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=SS1gseCUwdZRIxXyMpCWBiyoHSZLlh8x/v5IzcJUUh4=; b=Hi8WWeedgWVMI/5WdcsssH2mhpUCr4RwlACG1xTeXGPTc6pyTp7p9exy4wBNS/g1/t53 FtV6OO+woHzFmMTHCmNGg/qdrUvcV+BQv1xigisWYDJb8OPdfLZEzbja9nHxsvLzmML94 EVosH0SO8XJwz4ViZoUXEE5sYt5tcBFfEkgTU93WEyyjvDCI/BWbJuvJgHepWXj81g6vK w3FHXy/tgggUMZ2TnAeihlvzcac64Y6IbYJvGSu8yOKTSHxx/sFbHzyvqaW4H69N6hJMV utTp54MIPz2i5AoC47kL7Sq3jKkbJ0vqH6uXXaZMW/0xfk49SyobD7xamU345VewnnQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=UFDN8hBd; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F7B2606A325; Wed, 28 Oct 2026 18:34:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=UFDN8hBd Received: by smtp.kernel.org (Postfix) with ESMTPSA id EFE711F01825; Wed, 28 Oct 2026 18:34:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793212461; bh=SS1gseCUwdZRIxXyMpCWBiyoHSZLlh8x/v5IzcJUUh4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=UFDN8hBdU83B8C1vSpS49yuIUhkddEPSEsqzTTNjZvPs2qnh8KUEHjb4j60pxhjRu jim+8eVtsBoMwsNqIZl2/kCwHNi72AnAECRx/h35a60NTvU5GZANMhVWpyuuy10v3f OyYbMhg/lFJ2fvx70WDm/aYdrbJRf20qPtbJ1XCY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 6.1 0155/1887] netfilter: nf_tables: set->ops->insert returns opaque set element in case of EEXIST Date: Wed, 28 Oct 2026 17:37:31 +0100 Message-ID: <20261028170502.760980193@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028170459.200466217@linuxfoundation.org> References: <20261028170459.200466217@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Pablo Neira Ayuso [ Upstream commit 078996fcd657e6e0c3a72b7d5806d04c32e74250 ] Return struct nft_elem_priv instead of struct nft_set_ext for consistency with ("netfilter: nf_tables: expose opaque set element as struct nft_elem_priv") and to prepare the introduction of element timeout updates from control path. Signed-off-by: Pablo Neira Ayuso Backport notes for Linux 6.1: Keep the existing void-pointer representation of opaque set elements. The typed nft_elem_priv API and embedded priv members are not present in this branch, so return backend element pointers through void ** and derive the extension with nft_set_elem_ext() in the EEXIST handling path. Preserve the stable set_full accounting and PIPAPO's early initialization of e, and omit the unrelated timeout declaration reorder. No functions or new element representations are introduced. This prepares the catchall insert context for 70194dc37670 ("netfilter: nf_tables: skip expired catchall elements on insert and delete"); its timestamp and expiration helpers already exist in this branch. Stable-dep-of: 70194dc37670 ("netfilter: nf_tables: skip expired catchall elements on insert and delete") Signed-off-by: Sasha Levin --- include/net/netfilter/nf_tables.h | 2 +- net/netfilter/nf_tables_api.c | 15 +++++++++------ net/netfilter/nft_set_bitmap.c | 4 ++-- net/netfilter/nft_set_hash.c | 8 ++++---- net/netfilter/nft_set_pipapo.c | 10 +++++----- net/netfilter/nft_set_rbtree.c | 10 +++++----- 6 files changed, 26 insertions(+), 23 deletions(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index 7e63281f2d5a8..b8f283a6e718f 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -454,7 +454,7 @@ struct nft_set_ops { int (*insert)(const struct net *net, const struct nft_set *set, const struct nft_set_elem *elem, - struct nft_set_ext **ext); + void **priv); void (*activate)(const struct net *net, const struct nft_set *set, const struct nft_set_elem *elem); diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index a373a0969e994..17092456431db 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -6218,7 +6218,7 @@ EXPORT_SYMBOL_GPL(nft_set_catchall_lookup); static int nft_setelem_catchall_insert(const struct net *net, struct nft_set *set, const struct nft_set_elem *elem, - struct nft_set_ext **pext) + void **priv) { struct nft_set_elem_catchall *catchall; u8 genmask = nft_genmask_next(net); @@ -6227,7 +6227,7 @@ static int nft_setelem_catchall_insert(const struct net *net, list_for_each_entry(catchall, &set->catchall_list, list) { ext = nft_set_elem_ext(set, catchall->elem); if (nft_set_elem_active(ext, genmask)) { - *pext = ext; + *priv = catchall->elem; return -EEXIST; } } @@ -6245,14 +6245,15 @@ static int nft_setelem_catchall_insert(const struct net *net, static int nft_setelem_insert(const struct net *net, struct nft_set *set, const struct nft_set_elem *elem, - struct nft_set_ext **ext, unsigned int flags) + void **elem_priv, + unsigned int flags) { int ret; if (flags & NFT_SET_ELEM_CATCHALL) - ret = nft_setelem_catchall_insert(net, set, elem, ext); + ret = nft_setelem_catchall_insert(net, set, elem, elem_priv); else - ret = set->ops->insert(net, set, elem, ext); + ret = set->ops->insert(net, set, elem, elem_priv); return ret; } @@ -6420,6 +6421,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, enum nft_registers dreg; struct nft_trans *trans; bool set_full = false; + void *elem_priv; u64 timeout; u64 expiration; int err, i; @@ -6728,9 +6730,10 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, ext->genmask = nft_genmask_cur(ctx->net); - err = nft_setelem_insert(ctx->net, set, &elem, &ext2, flags); + err = nft_setelem_insert(ctx->net, set, &elem, &elem_priv, flags); if (err) { if (err == -EEXIST) { + ext2 = nft_set_elem_ext(set, elem_priv); if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^ nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) || nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^ diff --git a/net/netfilter/nft_set_bitmap.c b/net/netfilter/nft_set_bitmap.c index cbf7f7825f1b8..06b77100bef71 100644 --- a/net/netfilter/nft_set_bitmap.c +++ b/net/netfilter/nft_set_bitmap.c @@ -123,7 +123,7 @@ static void *nft_bitmap_get(const struct net *net, const struct nft_set *set, static int nft_bitmap_insert(const struct net *net, const struct nft_set *set, const struct nft_set_elem *elem, - struct nft_set_ext **ext) + void **elem_priv) { struct nft_bitmap *priv = nft_set_priv(set); struct nft_bitmap_elem *new = elem->priv, *be; @@ -132,7 +132,7 @@ static int nft_bitmap_insert(const struct net *net, const struct nft_set *set, be = nft_bitmap_elem_find(set, new, genmask); if (be) { - *ext = &be->ext; + *elem_priv = be; return -EEXIST; } diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c index 5a74ee4b7dfb3..60c0d72fb98b1 100644 --- a/net/netfilter/nft_set_hash.c +++ b/net/netfilter/nft_set_hash.c @@ -168,7 +168,7 @@ static bool nft_rhash_update(struct nft_set *set, const u32 *key, static int nft_rhash_insert(const struct net *net, const struct nft_set *set, const struct nft_set_elem *elem, - struct nft_set_ext **ext) + void **elem_priv) { struct nft_rhash *priv = nft_set_priv(set); struct nft_rhash_elem *he = elem->priv; @@ -185,7 +185,7 @@ static int nft_rhash_insert(const struct net *net, const struct nft_set *set, if (IS_ERR(prev)) return PTR_ERR(prev); if (prev) { - *ext = &prev->ext; + *elem_priv = prev; return -EEXIST; } return 0; @@ -588,7 +588,7 @@ static u32 nft_jhash(const struct nft_set *set, const struct nft_hash *priv, static int nft_hash_insert(const struct net *net, const struct nft_set *set, const struct nft_set_elem *elem, - struct nft_set_ext **ext) + void **elem_priv) { struct nft_hash_elem *this = elem->priv, *he; struct nft_hash *priv = nft_set_priv(set); @@ -600,7 +600,7 @@ static int nft_hash_insert(const struct net *net, const struct nft_set *set, if (!memcmp(nft_set_ext_key(&this->ext), nft_set_ext_key(&he->ext), set->klen) && nft_set_elem_active(&he->ext, genmask)) { - *ext = &he->ext; + *elem_priv = he; return -EEXIST; } } diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 4b37c6684bff6..c27ba1c5ae5da 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1260,13 +1260,13 @@ static struct nft_pipapo_match *pipapo_maybe_clone(const struct nft_set *set) * @net: Network namespace * @set: nftables API set representation * @elem: nftables API element representation containing key data - * @ext2: Filled with pointer to &struct nft_set_ext in inserted element + * @elem_priv: Filled with pointer to opaque set element * * Return: 0 on success, error pointer on failure. */ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, const struct nft_set_elem *elem, - struct nft_set_ext **ext2) + void **elem_priv) { const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); union nft_pipapo_map_bucket rulemap[NFT_PIPAPO_MAX_FIELDS]; @@ -1301,7 +1301,7 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, if (!memcmp(start, dup_key->data, sizeof(*dup_key->data)) && !memcmp(end, dup_end->data, sizeof(*dup_end->data))) { - *ext2 = &dup->ext; + *elem_priv = dup; return -EEXIST; } @@ -1317,7 +1317,7 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, if (PTR_ERR(dup) != -ENOENT) { if (IS_ERR(dup)) return PTR_ERR(dup); - *ext2 = &dup->ext; + *elem_priv = dup; return -ENOTEMPTY; } @@ -1379,7 +1379,7 @@ static int nft_pipapo_insert(const struct net *net, const struct nft_set *set, put_cpu_ptr(m->scratch); } - *ext2 = &e->ext; + *elem_priv = e; pipapo_map(m, rulemap, e); diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c index 433094c4200f9..e82e5cf107ee4 100644 --- a/net/netfilter/nft_set_rbtree.c +++ b/net/netfilter/nft_set_rbtree.c @@ -319,7 +319,7 @@ static struct nft_rbtree_elem *nft_rbtree_prev_active(struct nft_rbtree_elem *rb static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, struct nft_rbtree_elem *new, - struct nft_set_ext **ext) + void **elem_priv) { struct nft_rbtree_elem *rbe, *rbe_le = NULL, *rbe_ge = NULL, *rbe_prev; struct rb_node *node, *next, *parent, **p, *first = NULL; @@ -437,7 +437,7 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, */ if (rbe_ge && !nft_rbtree_cmp(set, new, rbe_ge) && nft_rbtree_interval_start(rbe_ge) == nft_rbtree_interval_start(new)) { - *ext = &rbe_ge->ext; + *elem_priv = rbe_ge; return -EEXIST; } @@ -446,7 +446,7 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, */ if (rbe_le && !nft_rbtree_cmp(set, new, rbe_le) && nft_rbtree_interval_end(rbe_le) == nft_rbtree_interval_end(new)) { - *ext = &rbe_le->ext; + *elem_priv = rbe_le; return -EEXIST; } @@ -506,7 +506,7 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, static int nft_rbtree_insert(const struct net *net, const struct nft_set *set, const struct nft_set_elem *elem, - struct nft_set_ext **ext) + void **elem_priv) { struct nft_rbtree *priv = nft_set_priv(set); struct nft_rbtree_elem *rbe = elem->priv; @@ -520,7 +520,7 @@ static int nft_rbtree_insert(const struct net *net, const struct nft_set *set, write_lock_bh(&priv->lock); write_seqcount_begin(&priv->count); - err = __nft_rbtree_insert(net, set, rbe, ext); + err = __nft_rbtree_insert(net, set, rbe, elem_priv); write_seqcount_end(&priv->count); write_unlock_bh(&priv->lock); } while (err == -EAGAIN); -- 2.53.0