From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [91.216.245.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DAC473D811A; Wed, 25 Mar 2026 13:11:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.216.245.30 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774444309; cv=none; b=omn9CpjrTSnVil03bbMuKi3/BmKbMQqurzRVlw7b4SlI+FHcyGJjTMEfTPokKAZRfut119rNs3xNFfyC3kJCfAcer9axeZSktLQgXPS3Zo+TVX3lHUBOgp5oa0Hv/N7OybHLkqAbyk5bvFkfAvmurbwg2c8RBQoW38t5odPU41g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774444309; c=relaxed/simple; bh=7LJwjfMW+33BUDCwZ+QwbkDerNfIMt/vKofRzW3dKCE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ShAflMilGOp9LnoQMbGbXrT1kwXksIIGuDrQ1d9NsaOYgQ+8Z+fOkyaTp9KaMdNX7uIuNiFYdnC64CPo2wysqbmnb4PNPGPEYB4FyMoqI7zj5kzqTZwZ8BKS2hAOHiS6NlhI076cMdWaUtcHzJA2LAH7RAgBpsnGuBBSr+vMcjo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de; spf=pass smtp.mailfrom=Chamillionaire.breakpoint.cc; arc=none smtp.client-ip=91.216.245.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=strlen.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=Chamillionaire.breakpoint.cc Received: by Chamillionaire.breakpoint.cc (Postfix, from userid 1003) id 600006080C; Wed, 25 Mar 2026 14:11:46 +0100 (CET) From: Florian Westphal To: Cc: Paolo Abeni , "David S. Miller" , Eric Dumazet , Jakub Kicinski , , pablo@netfilter.org Subject: [PATCH net 03/14] netfilter: ipset: Fix data race between add and list header in all hash types Date: Wed, 25 Mar 2026 14:10:57 +0100 Message-ID: <20260325131108.23045-4-fw@strlen.de> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260325131108.23045-1-fw@strlen.de> References: <20260325131108.23045-1-fw@strlen.de> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Jozsef Kadlecsik The "ipset list -terse" command is actually a dump operation which may run parallel with "ipset add" commands, which can trigger an internal resizing of the hash type of sets just being dumped. However, dumping just the header part of the set was not protected against underlying resizing. Fix it by protecting the header dumping part as well. Reported-by: syzbot+786c889f046e8b003ca6@syzkaller.appspotmail.com Signed-off-by: Jozsef Kadlecsik Signed-off-by: Florian Westphal --- net/netfilter/ipset/ip_set_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c index a2fe711cb5e3..2cc04da95afd 100644 --- a/net/netfilter/ipset/ip_set_core.c +++ b/net/netfilter/ipset/ip_set_core.c @@ -1648,13 +1648,13 @@ ip_set_dump_do(struct sk_buff *skb, struct netlink_callback *cb) if (cb->args[IPSET_CB_PROTO] > IPSET_PROTOCOL_MIN && nla_put_net16(skb, IPSET_ATTR_INDEX, htons(index))) goto nla_put_failure; + if (set->variant->uref) + set->variant->uref(set, cb, true); ret = set->variant->head(set, skb); if (ret < 0) goto release_refcount; if (dump_flags & IPSET_FLAG_LIST_HEADER) goto next_set; - if (set->variant->uref) - set->variant->uref(set, cb, true); fallthrough; default: ret = set->variant->list(set, skb, cb); -- 2.52.0