From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yw1-f172.google.com (mail-yw1-f172.google.com [209.85.128.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 00EE3385D77 for ; Thu, 20 Aug 2026 03:43:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787197408; cv=none; b=GfFCqXOdlm8antulh9WGMm75HiqHDrfJcC6WZC9qheSOslVC1RzhwMIuOoy9rRpdGTMou8Y65wOpKqeMLcG8wcEjj3MJ7ziVhzQncAeO/0iCf6fv208NN0WIoYS+7gqe53oPyCnuuffRuwS0q/rNaa5CgvGbXl1aUK8aFzNbkL0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787197408; c=relaxed/simple; bh=SUQUzfU153V9eAP2f4m6jjHNOdZgZOb4ZUg9by6Fk1I=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hEPO7+fl/j0YC/imKNr7FLR/5Vk7AfbE1JEb52wCqCp9NfdHKs20D0+dwQ0YTdsdgN1Z7iQzS0eKubQNlY9l7p+7SpBFJLsTe+nECxwW7XtzBPaYiyB7gy1iZ5bAV1i9K98VhGYmMfgnBMkwji1KyU/MyidiGxPtX2oZXFaUdrI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KdddVRaB; arc=none smtp.client-ip=209.85.128.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KdddVRaB" Received: by mail-yw1-f172.google.com with SMTP id 00721157ae682-81f3b227a4aso30751907b3.1 for ; Wed, 19 Aug 2026 20:43:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787197406; x=1787802206; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=SUQUzfU153V9eAP2f4m6jjHNOdZgZOb4ZUg9by6Fk1I=; b=KdddVRaBHkdbDzv1+fCe2TxwckQxpPZkLNre5pUV9eVFReDiz3KBvlu3VUWYPGU2tf kGA36X1YMMutyJiLw9eI4bUcZyIqsD5dhn7+hbvVU2dpTi/Ixf3hCa9ysjLOTBWkweTz 3SauJS1bQuqq0TcBKoDfEUsAL5FfwDLViwiYlGo61WzTUtvZP1o84EEqAtFDS/vCdK4C mXM6IErSz+55VBc5zA8Dx35W+20oB4iqyNgiWmuvSwNyA2iWyK+rJ6ivEfh7JPMfTomO L9nGtHkbKrmDjKa+JrSvIO8pzeiEzmZ9I6iIyS03u8rO6sgGKbQvo2uFBMn4hBPjGc4h mE5g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787197406; x=1787802206; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=SUQUzfU153V9eAP2f4m6jjHNOdZgZOb4ZUg9by6Fk1I=; b=Hfgt65ylbbp1OhbbKmYKRnF77g1MoYiESBEq2/mIPvDPLAVr3tH8uz7HxlWAZTQfbB QNQNSaMjAfrCsMqJeFKUrZl/9N6vOAj7NcF6rNv4gHBjwP/P4K7eSbrvwiLwYOMCgzSd ftbadbxsu9Ur8NRVN7xLQN5+x0uirh8bflzWMEzWRcZBUCAIwrLAwKuRFyIYV3KGo+Me GwCMZqrVDJD5cfye70wIPUVVruj+8glPWZX0rjZr7TWxweNXHD+N8b6ytx6/1GogaEeT qFmD9h2M8Rry13STuOqvEH8ou0v7gu8KlQHbREn7QbCVgA5sAnFa0dWYVV7WjLn0Jj0F 5t6w== X-Forwarded-Encrypted: i=1; AHgh+RrkQ0KZ9F2IVbPGWe3rmBlmieTQJcUgn7M3F9mEFwHft8O2LAkB8iSv7DVzYmjCv7J3rhYe2IVok2slM1o=@vger.kernel.org X-Gm-Message-State: AFuF++kXLinGpQdTOiL6F1xaQZODxDjYUUwuqlSbgr/UeX7Y6V00B3hY ElyxzS3T0oRbnyXPBrd0HTDvUYgSFkfCQ3OnQvB40m4prFsm0TLcf17W X-Gm-Gg: AR+sD13iLEbU4Z8/3u5/IyC+6OtN3kUNSJWKJVZBD/D7Yk336XTgrYo8q1Ko5m2MdGZ 4IismHZKBLm3UtcrFkyV7+VuWJeE3hLU/XcZhO7emdgle7C3z2PnUXH2DrFSh5GQdyTbaxGk+ec 17hoBo3rP42W+uFy69ygAVVSZrs4cai9+2OT7rkNbgdFb2WLINy/jGl3Nt3ByoFzbiEDkV1nZ6Y h6yTDRDB6FriLyMkSXvwk9kWklExm7UczjwyBbW35z/5fSguaOJfjWGuCIIcAU1DO0gUnV5P65n ycdHMm91EvhujKJ+lRLBwoKAUORM/DifEGLLgz9gQN23aBrBhHYEt936dz2YrCjVREAN/awpio4 nj6lkriSMVFMGt8zVjToIfR3VF+LgqNrFoVviN0YA5AZv2gcM3C+54BPge3PPfexupJhSrmbGjV UJmaPtXnoEyXzH/y9NGzLPiobOKFEJoZWWdFonA+t3g9sGkuVgeJ+w9k7ODZAET1Yb1qo= X-Received: by 2002:a05:690c:3387:b0:81e:89b2:91ae with SMTP id 00721157ae682-844e378f1a5mr42081877b3.21.1787197405974; Wed, 19 Aug 2026 20:43:25 -0700 (PDT) Received: from mac.lan ([136.55.173.105]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-66ccafd03basm2037809d50.1.2026.08.19.20.43.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Aug 2026 20:43:25 -0700 (PDT) From: "Cen Zhang (Microsoft)" To: xuanqiang.luo@linux.dev Cc: AutonomousCodeSecurity@microsoft.com, blbllhy@gmail.com, coreteam@netfilter.org, davem@davemloft.net, edumazet@google.com, enrico.pozzobon@dissecto.com, fw@strlen.de, horms@kernel.org, kadlec@netfilter.org, kees@kernel.org, kuba@kernel.org, kys@microsoft.com, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, pabeni@redhat.com, pablo@netfilter.org, phil@nwl.cc, sbrivio@redhat.com, tgopinath@linux.microsoft.com, xmei5@asu.edu Subject: Re: [PATCH net] netfilter: ipset: list:set: defer ip_set_put_byindex to RCU callback Date: Wed, 19 Aug 2026 23:43:17 -0400 Message-ID: <20260820034317.79295-1-blbllhy@gmail.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Hi Xuanqiang, Thanks for the review. You're right that this effectively restores the stale-refcount window fixed by 439cd39ea136. I was aware of that trade-off, but focused first on preventing the kernel BUG that can be triggered by an unprivileged user. I agree that the final fix should address both issues. I'll rework the fix and send a v2. Suggestions on the preferred approach are welcome. Thanks, Cen