Re: [PATCH v3 6.6.y 0/8] netfilter: nft_set_pipapo: move clone allocation to insert/removal path

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

Thanks for your series.

Please, hold on on this series until someone authoritative on
Netfilter can review this.

On Wed, Mar 04, 2026 at 08:54:38PM +0400, Natarajan KV wrote:
> This is a backport of the following mainline series to 6.6.122:
> 
>   a590f4760922 ("netfilter: nft_set_pipapo: move prove_locking helper around")
>   80efd2997fb9 ("netfilter: nft_set_pipapo: make pipapo_clone helper return NULL")
>   8b8a2417558c ("netfilter: nft_set_pipapo: prepare destroy function for on-demand clone")
>   6c108d9bee44 ("netfilter: nft_set_pipapo: prepare walk function for on-demand clone")
>   c5444786d0ea ("netfilter: nft_set_pipapo: merge deactivate helper into caller")
>   a238106703ab ("netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone")
>   3f1d886cc7c3 ("netfilter: nft_set_pipapo: move cloning of match info to insert/removal path")
>   532aec7e878b ("netfilter: nft_set_pipapo: remove dirty flag")
> 
> The pipapo set backend currently calls pipapo_clone() from the commit
> and abort callbacks. These callbacks must not fail, but pipapo_clone()
> can fail with ENOMEM. When this happens, the working copy ends up in a
> corrupt state: freed elements remain accessible, and the dirty flag stays
> set, causing the next commit to promote a stale clone.
> 
> This series moves pipapo_clone() to the insert and removal paths via a
> new pipapo_maybe_clone() helper that creates the working copy on demand
> and can propagate -ENOMEM to the caller.
> 
> Patches 1-4 cherry-pick cleanly from mainline.
> Patches 5-8 are adapted for 6.6.122's different API:
>  - nft_pipapo_flush() still uses the pipapo_deactivate() helper
>    (mainline removed it via the elem_priv refactor)
>  - pipapo_get() has no GFP parameter (always GFP_ATOMIC)
>  - nft_pipapo_commit() is non-const in 6.6.x
> 
> Build-tested with both nft_set_pipapo.o and nft_set_pipapo_avx2.o.
> 
> Florian Westphal (8):
>   netfilter: nft_set_pipapo: move prove_locking helper around
>   netfilter: nft_set_pipapo: make pipapo_clone helper return NULL
>   netfilter: nft_set_pipapo: prepare destroy function for on-demand clone
>   netfilter: nft_set_pipapo: prepare walk function for on-demand clone
>   netfilter: nft_set_pipapo: merge deactivate helper into caller
>   netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone
>   netfilter: nft_set_pipapo: move cloning of match info to insert/removal path
>   netfilter: nft_set_pipapo: remove dirty flag
> 
>  net/netfilter/nft_set_pipapo.c | 196 +++++++++++++++++---------------
>  net/netfilter/nft_set_pipapo.h |   6 --
>  2 files changed, 107 insertions(+), 95 deletions(-)
> 
> -- 
> 2.39.5