[PATCH] netfilter: nft_set_pipapo: clear dirty flag on abort/commit clone failure

[Natarajan KV <natarajankv91@gmail.com>]

nft_pipapo_abort() and nft_pipapo_commit() call pipapo_clone() which
can fail under memory pressure. When this happens, the functions return
early without clearing priv->dirty. Since the set_ops->abort callback
returns void, the nf_tables framework cannot detect this failure.

The stale clone, which still contains modifications from the failed
transaction, persists with dirty == true. On a subsequent commit,
nft_pipapo_commit() sees dirty == true and promotes the stale clone
to the active match via rcu_assign_pointer(), causing the lookup data
to reflect operations that should have been rolled back.

This can lead to incorrect packet matching (firewall rule bypass),
memory leaks from unreachable elements, and potential use-after-free
if elements freed by the framework are still referenced through
stale clone mapping tables.

In mainline, this was resolved by commit 212ed75dc5fb ("netfilter:
nf_tables: integrate pipapo into commit protocol") which refactored
pipapo to use dedicated set commit/abort ops, eliminating
pipapo_clone() from the abort path entirely. That refactor touches
3 files and modifies the nf_tables framework, making it too invasive
to backport to stable branches.

Fix this minimally by clearing priv->dirty when pipapo_clone() fails
in both nft_pipapo_commit() and nft_pipapo_abort(), preventing stale
clone promotion on subsequent commits.

Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Cc: stable@vger.kernel.org
Signed-off-by: Natarajan KV <natarajankv91@gmail.com>
---
 net/netfilter/nft_set_pipapo.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
index 4274831b6e67..34a108399fd3 100644
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -1708,8 +1708,10 @@ static void nft_pipapo_commit(struct nft_set *set)
 		return;
 
 	new_clone = pipapo_clone(priv->clone);
-	if (IS_ERR(new_clone))
+	if (IS_ERR(new_clone)) {
+		priv->dirty = false;
 		return;
+	}
 
 	priv->dirty = false;
 
@@ -1743,8 +1745,10 @@ static void nft_pipapo_abort(const struct nft_set *set)
 	m = rcu_dereference_protected(priv->match, nft_pipapo_transaction_mutex_held(set));
 
 	new_clone = pipapo_clone(m);
-	if (IS_ERR(new_clone))
+	if (IS_ERR(new_clone)) {
+		priv->dirty = false;
 		return;
+	}
 
 	priv->dirty = false;
 
-- 
2.34.1