From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yw1-f169.google.com (mail-yw1-f169.google.com [209.85.128.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 865611F12FB for ; Thu, 20 Aug 2026 01:06:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787187983; cv=none; b=PFWsucPZZUDnis3RwrmbzeGcG8K+jELNj27HmD8ewAX133+SIQMAr/NgeDwv3QB+yKe1iapHzRUswQXwhYiFZ/XqENWUKMBbd3mHsqazfSUBEsCwfMQBVxMth9BpNXYELvThKortUDf4PLAt7HMWMA8pR/xmFSSGItrKcJAeLCY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787187983; c=relaxed/simple; bh=6n/uZQR5aUanqHSqO5R7Kh+SBqhfqON4fmhIll6OHqo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=oXTmK/zQ32/Lk0yHPODWhVUyPBTn4z2IHwUM0l4rAXDS7wGOlQD/4iVH8ssgae0c6uqGo9HSxOcS0r/pW1ls1wbk6HLxbVdcMN391iswO2wmP8wNx7zjAeOwWOyXmjcIfswFvOhKltmrQd0KKiwjzydS9E6eWiwP7tOKonxeQGk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=MjuF76uJ; arc=none smtp.client-ip=209.85.128.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="MjuF76uJ" Received: by mail-yw1-f169.google.com with SMTP id 00721157ae682-836c8bdac50so25883867b3.0 for ; Wed, 19 Aug 2026 18:06:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787187979; x=1787792779; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=o36bXNM2ARffm3iLy4WlKgnd3gxGay/ODxd6X4i877s=; b=MjuF76uJ7Z3vgt68EHJBnR1BO4TG9iFtvFYMhzjue2x2q78vNlOExgdCUIJ9BTtOu+ IAbaGVTV9Q3N/A9zTgPLQvqbwMpslJUp2YOKSNGQtD01Id8wvV9iFJH6ybjiRH+py6dy YPuyTn+VgFxx1Seei8tuDwDtfGMW98Dl8rFqfqpvnlmTR7MRabQJPkHGhgf5oQVf1lk7 QNTRynpSVfhTkfNafI6kte2jvVjz4NGB7KHqJeSkc907yxPZmMK2MaORngKemO0l+X/y AptXQ1kxpYcGd6bqJC3hScubhBJbAI0miuWbAX24VeRNFf0aJSfiEi9cdBG0rQ9j6pSk gtuA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787187979; x=1787792779; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=o36bXNM2ARffm3iLy4WlKgnd3gxGay/ODxd6X4i877s=; b=lq3ZFE6cP2hMF1xF00vKgyQE1jhhE9V2HDLKpyaYkVViJDVkb+tZkOBS76g+TDC3NX /4haz0RIr7HibhYbQV7KMoUFRMbgRcOyF8/veGahLeM2hdSZOb4ozL4+axcTzlDC82pP d0n7g8Dmr9x0wkVSs5JtUd/+rXpZuHJrQefw76NWflZAfBv3V+IRxonn7dOCcCesHrlc kvp/SHD6ByUWyhmcT6U09xB9COOICHh25QBdCNoAjcNjsPNqWZEgvo4q8IanUfBMY6ph OytJ7e+IimGRH2GLQrThh1NxncV674kXsJyRPo3iwttiT1/KqY1890p4NoWObDxNjIek KYkA== X-Forwarded-Encrypted: i=1; AHgh+RqnYzJXCydcbr9SiiAwlBQqPQp/Xv0ygRq/JvkTDgmahs3ZJHeX239D8bE8U9jyn4+M0Mpe54zbLEnFe0A=@vger.kernel.org X-Gm-Message-State: AFuF++lpjzhQwYWmt8vsyeAmggPbtSf9DFADshTC73DSCERvdAMojg3J 003tsFvQ0bl9RPwq/I4itJE7oV5M8MCoWNW2uI5aUGPoPsvK9A3WAO2M X-Gm-Gg: AR+sD11y8a7wAZpkzmvDpRCWniSVxIXvzokZvn79XsfHily+puHfJjkxv6l0vMCYk4V wpwgmVsM9y6LaiFjhQUYTlKU3AIpz/8JKhXue1tbux4OMOMSDTzJfg+aiGKuHyxOdLvZbkghp9N 0hpDrULzGU/230Opc8V8UcJdDw+oooVg9XqE6vVDiBsX2GYn6I/TJHSahhACL2um4A28EjhP1eU VW+WkZTm7voDejGl176Wyn12y6DNXQUR4SB4UfdW+yVGV5xrsr43qhoXTUcV23bEs4wsvnP6zaq laFWBFArHGXd37yyb0pEA7etyqcyYlpunQ1cNQgeKnWY2wNLFVgJbGviEwGsKNuwvhpHb85XEqm QKopiAK1gUTQKwt877xHEIGKMvWPVs7xtap2LR7y4A7O8XW6y2TBHRdzVOtG3DID2vrt3GN9Rfx rm45vlNrZ5lbqlUzM6q0IHQYYYk3D0Bq5BU77IUnDIPxlyhPhbLJJOQj/CoH20exB5xeZYUc6sE CD2qQ== X-Received: by 2002:a05:690e:450a:10b0:668:9fa5:b9cc with SMTP id 956f58d0204a3-66ccb4070bcmr2684977d50.0.1787187979411; Wed, 19 Aug 2026 18:06:19 -0700 (PDT) Received: from mac.lan ([136.55.173.105]) by smtp.gmail.com with ESMTPSA id 00721157ae682-84511abb205sm17428687b3.6.2026.08.19.18.06.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 18:06:18 -0700 (PDT) From: "Cen Zhang (Microsoft)" To: pablo@netfilter.org, fw@strlen.de, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: phil@nwl.cc, horms@kernel.org, kadlec@netfilter.org, kees@kernel.org, enrico.pozzobon@dissecto.com, sbrivio@redhat.com, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, AutonomousCodeSecurity@microsoft.com, xmei5@asu.edu, tgopinath@linux.microsoft.com, kys@microsoft.com, blbllhy@gmail.com Subject: [PATCH net] netfilter: ipset: list:set: defer ip_set_put_byindex to RCU callback Date: Wed, 19 Aug 2026 21:06:17 -0400 Message-ID: <20260820010617.46851-1-blbllhy@gmail.com> X-Mailer: git-send-email 2.52.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit list_set_del() and list_set_replace() call ip_set_put_byindex() before call_rcu(), dropping the child set refcount to zero. Meanwhile, list_set_ktest() on another CPU may have already read e->id under rcu_read_lock(). A concurrent ip_set_destroy() sees refcount zero, NULLs ip_set_list[index], and frees the child set. list_set_ktest() then passes the now-dangling index to ip_set_test(), ip_set_rcu_get() returns NULL, and BUG_ON(!set) fires at ip_set_core.c:746. kernel BUG at net/netfilter/ipset/ip_set_core.c:746! ip_set_test+0x329/0x590 list_set_kadt+0x2a6/0x810 ip_set_test+0x24f/0x590 set_match_v1+0x1a9/0x280 ipt_do_table+0x83d/0x1360 nf_hook_slow+0xac/0x1e0 Move ip_set_put_byindex() from list_set_del()/list_set_replace() into the __list_set_del_rcu() callback so the refcount is not decremented until all RCU readers have finished. Fixes: 439cd39ea136 ("netfilter: ipset: list:set: Decrease refcount synchronously on deletion and replace") Reported-by: AutonomousCodeSecurity@microsoft.com Reported-by: Xiang Mei (Microsoft) Reported-by: Cen Zhang (Microsoft) Signed-off-by: Cen Zhang (Microsoft) --- net/netfilter/ipset/ip_set_list_set.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c index f070088742d6..aeee0c6c314d 100644 --- a/net/netfilter/ipset/ip_set_list_set.c +++ b/net/netfilter/ipset/ip_set_list_set.c @@ -144,7 +144,9 @@ __list_set_del_rcu(struct rcu_head * rcu) { struct set_elem *e = container_of(rcu, struct set_elem, rcu); struct ip_set *set = e->set; + struct list_set *map = set->data; + ip_set_put_byindex(map->net, e->id); ip_set_ext_destroy(set, e); kfree(e); } @@ -152,21 +154,15 @@ __list_set_del_rcu(struct rcu_head * rcu) static void list_set_del(struct ip_set *set, struct set_elem *e) { - struct list_set *map = set->data; - set->elements--; list_del_rcu(&e->list); - ip_set_put_byindex(map->net, e->id); call_rcu(&e->rcu, __list_set_del_rcu); } static void list_set_replace(struct ip_set *set, struct set_elem *e, struct set_elem *old) { - struct list_set *map = set->data; - list_replace_rcu(&old->list, &e->list); - ip_set_put_byindex(map->net, old->id); call_rcu(&old->rcu, __list_set_del_rcu); } -- 2.52.0