Re: [PATCH] netfilter: nft_set_pipapo: clear dirty flag on abort/commit clone failure

[Greg KH <gregkh@linuxfoundation.org>]

On Wed, Mar 04, 2026 at 05:38:59PM +0400, Natarajan KV wrote:
> nft_pipapo_abort() and nft_pipapo_commit() call pipapo_clone() which
> can fail under memory pressure. When this happens, the functions return
> early without clearing priv->dirty. Since the set_ops->abort callback
> returns void, the nf_tables framework cannot detect this failure.
> 
> The stale clone, which still contains modifications from the failed
> transaction, persists with dirty == true. On a subsequent commit,
> nft_pipapo_commit() sees dirty == true and promotes the stale clone
> to the active match via rcu_assign_pointer(), causing the lookup data
> to reflect operations that should have been rolled back.
> 
> This can lead to incorrect packet matching (firewall rule bypass),
> memory leaks from unreachable elements, and potential use-after-free
> if elements freed by the framework are still referenced through
> stale clone mapping tables.
> 
> In mainline, this was resolved by commit 212ed75dc5fb ("netfilter:
> nf_tables: integrate pipapo into commit protocol") which refactored
> pipapo to use dedicated set commit/abort ops, eliminating
> pipapo_clone() from the abort path entirely. That refactor touches
> 3 files and modifies the nf_tables framework, making it too invasive
> to backport to stable branches.
> 
> Fix this minimally by clearing priv->dirty when pipapo_clone() fails
> in both nft_pipapo_commit() and nft_pipapo_abort(), preventing stale
> clone promotion on subsequent commits.
> 
> Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
> Cc: stable@vger.kernel.org
> Signed-off-by: Natarajan KV <natarajankv91@gmail.com>
> ---
>  net/netfilter/nft_set_pipapo.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c
> index 4274831b6e67..34a108399fd3 100644
> --- a/net/netfilter/nft_set_pipapo.c
> +++ b/net/netfilter/nft_set_pipapo.c
> @@ -1708,8 +1708,10 @@ static void nft_pipapo_commit(struct nft_set *set)
>  		return;
>  
>  	new_clone = pipapo_clone(priv->clone);
> -	if (IS_ERR(new_clone))
> +	if (IS_ERR(new_clone)) {
> +		priv->dirty = false;
>  		return;
> +	}
>  
>  	priv->dirty = false;
>  
> @@ -1743,8 +1745,10 @@ static void nft_pipapo_abort(const struct nft_set *set)
>  	m = rcu_dereference_protected(priv->match, nft_pipapo_transaction_mutex_held(set));
>  
>  	new_clone = pipapo_clone(m);
> -	if (IS_ERR(new_clone))
> +	if (IS_ERR(new_clone)) {
> +		priv->dirty = false;
>  		return;
> +	}
>  
>  	priv->dirty = false;
>  
> -- 
> 2.34.1
> 

<formletter>

This is not the correct way to submit patches for inclusion in the
stable kernel tree.  Please read:
    https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.

</formletter>