* [PATCH 1/1] netfilter: ipset: drop logically empty buckets in mtype_del
[not found] <cover.1774578045.git.yifanwucs@gmail.com>
@ 2026-03-27 5:50 ` Yuan Tan
2026-03-27 10:36 ` Phil Sutter
0 siblings, 1 reply; 2+ messages in thread
From: Yuan Tan @ 2026-03-27 5:50 UTC (permalink / raw)
To: security
Cc: pablo, fw, phil, davem, edumazet, kuba, pabeni, horms, zhen.ni,
kadlec, kees, tomapufckgml, dstsmallbird, yifanwucs, yuantan098,
stable
From: Yifan Wu <yifanwucs@gmail.com>
mtype_del() counts empty slots below n->pos in k, but it only drops the
bucket when both n->pos and k are zero. This misses buckets whose live
entries have all been removed while n->pos still points past deleted slots.
Treat a bucket as empty when all positions below n->pos are unused and
release it directly instead of shrinking it further.
Fixes: 8af1c6fbd923 ("netfilter: ipset: Fix forceadd evaluation path")
Cc: stable@vger.kernel.org
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <dstsmallbird@foxmail.com>
Signed-off-by: Yifan Wu <yifanwucs@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
---
net/netfilter/ipset/ip_set_hash_gen.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index 181daa9c2019..b79e5dd2af03 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -1098,7 +1098,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext,
if (!test_bit(i, n->used))
k++;
}
- if (n->pos == 0 && k == 0) {
+ if (k == n->pos) {
t->hregion[r].ext_size -= ext_size(n->size, dsize);
rcu_assign_pointer(hbucket(t, key), NULL);
kfree_rcu(n, rcu);
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH 1/1] netfilter: ipset: drop logically empty buckets in mtype_del
2026-03-27 5:50 ` [PATCH 1/1] netfilter: ipset: drop logically empty buckets in mtype_del Yuan Tan
@ 2026-03-27 10:36 ` Phil Sutter
0 siblings, 0 replies; 2+ messages in thread
From: Phil Sutter @ 2026-03-27 10:36 UTC (permalink / raw)
To: Yuan Tan
Cc: security, pablo, fw, davem, edumazet, kuba, pabeni, horms,
zhen.ni, kadlec, kees, tomapufckgml, dstsmallbird, yifanwucs,
stable
On Thu, Mar 26, 2026 at 10:50:38PM -0700, Yuan Tan wrote:
> From: Yifan Wu <yifanwucs@gmail.com>
>
> mtype_del() counts empty slots below n->pos in k, but it only drops the
> bucket when both n->pos and k are zero. This misses buckets whose live
> entries have all been removed while n->pos still points past deleted slots.
>
> Treat a bucket as empty when all positions below n->pos are unused and
> release it directly instead of shrinking it further.
>
> Fixes: 8af1c6fbd923 ("netfilter: ipset: Fix forceadd evaluation path")
> Cc: stable@vger.kernel.org
> Reported-by: Juefei Pu <tomapufckgml@gmail.com>
> Reported-by: Xin Liu <dstsmallbird@foxmail.com>
> Signed-off-by: Yifan Wu <yifanwucs@gmail.com>
> Co-developed-by: Yuan Tan <yuantan098@gmail.com>
> Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Reviewed-by: Phil Sutter <phil@nwl.cc>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-03-27 10:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <cover.1774578045.git.yifanwucs@gmail.com>
2026-03-27 5:50 ` [PATCH 1/1] netfilter: ipset: drop logically empty buckets in mtype_del Yuan Tan
2026-03-27 10:36 ` Phil Sutter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox