diff options
| author | Jozsef Kadlecsik <kadlec@netfilter.org> | 2023-09-19 20:04:45 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2023-09-20 10:35:24 +0200 |
| commit | 7433b6d2afd512d04398c73aa984d1e285be125b (patch) | |
| tree | c90fd10963400937c718053a2be2f74face6d063 /arch | |
| parent | cf5000a7787cbc10341091d37245a42c119d26c5 (diff) | |
netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
Kyle Zeng reported that there is a race between IPSET_CMD_ADD and IPSET_CMD_SWAP
in netfilter/ip_set, which can lead to the invocation of `__ip_set_put` on a
wrong `set`, triggering the `BUG_ON(set->ref == 0);` check in it.
The race is caused by using the wrong reference counter, i.e. the ref counter instead
of ref_netlink.
Fixes: 24e227896bbf ("netfilter: ipset: Add schedule point in call_ad().")
Reported-by: Kyle Zeng <zengyhkyle@gmail.com>
Closes: https://lore.kernel.org/netfilter-devel/ZPZqetxOmH+w%2Fmyc@westworld/#r
Tested-by: Kyle Zeng <zengyhkyle@gmail.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'arch')
0 files changed, 0 insertions, 0 deletions