[PATCH 0/1] ipset patch to fix race condition between swap/destroy and add/del/test, v3

[Jozsef Kadlecsik <kadlec@netfilter.org>]

Hi Pablo,

[Resend: sorry, patch subject was not updated properly.]

Please apply the next patch to your nf tree, which fixes a race condition:

* There's a race between a fast swap/destroy and a slow kernel side add/del/test element
  operation in ipset. The attached patch fixes it by forcing ip_set_swap() to wait for
  all readers to finish accessing the old set pointers.
  v2: synchronize_rcu() is moved into ip_set_swap() in order not to burden
      ip_set_destroy() unnecessarily when all sets are destroyed.
  v3: Florian Westphal pointed out that all netfilter hooks run with rcu_read_lock() held
      and em_ipset.c wraps the entire ip_set_test() in rcu read lock/unlock pair
      So there's no need to extend the rcu read locked area in ipset itse

Thanks!
Jozsef

The following changes since commit 7153a404fb70d21097af3169354e1e5fda3fbb02:

  Merge tag 'nf-23-09-06' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf (2023-09-07 11:47:15 +0200)

are available in the Git repository at:

  git://blackhole.kfki.hu/nf 2c9d59f0074ade

for you to fetch changes up to 2c9d59f0074ade26f2324209383d3699ad1790be:

  netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test, v3 (2023-11-13 21:10:42 +0100)

----------------------------------------------------------------
Jozsef Kadlecsik (1):
      netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test, v3

 net/netfilter/ipset/ip_set_core.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)