Re: [PATCH 1/1] netfilter: ipset: Fix set:list type crash when flush/dump set in parallel

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Feb 24, 2016 at 09:19:26PM +0100, Jozsef Kadlecsik wrote:
> Flushing/listing entries was not RCU safe, so parallel flush/dump
> could lead to kernel crash. Bug reported by Deniz Eren.
> 
> Fixes netfilter bugzilla id #1050.
> 
> Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
> ---
>  net/netfilter/ipset/ip_set_core.c     |  3 ++
>  net/netfilter/ipset/ip_set_list_set.c | 55 ++++++++++++++++-------------------
>  2 files changed, 28 insertions(+), 30 deletions(-)
> 
> diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
> index 95db43f..7e6568c 100644
> --- a/net/netfilter/ipset/ip_set_core.c
> +++ b/net/netfilter/ipset/ip_set_core.c
> @@ -985,6 +985,9 @@ static int ip_set_destroy(struct net *net, struct sock *ctnl,
>  	if (unlikely(protocol_failed(attr)))
>  		return -IPSET_ERR_PROTOCOL;
>  
> +	/* Must wait for flush to be really finished in list:set */
> +	rcu_barrier();

Jozsef, are you sure you need this rcu_barrier()?

This is waiting for rcu callback completion (ie. decrement the set
reference counter and releasing the extension and object itself).

The rcu read side should be safe when accessing old copies from the
dumping path when using call_rcu().

Let me know, thanks!