mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 08:15:07 -04:00
Code Issues Packages Projects Releases Wiki Activity

netfilter: nf_tables: set on dead bit when performing early element removal

Browse Source 
.commit call for sets is skipped if set->dead flag is set on, but this
flag is set on later in the commit path.

This also reintroduces the bug fixed in commit 7315dc1e12
("netfilter: nf_tables: skip set commit for deleted/destroyed sets").

Fixes: 1e3b9e1c77 ("netfilter: nf_tables: call set ops .commit when building new ruleset blob")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso
2026-08-20 10:26:32 +02:00
parent 43559058d2
commit 132a02beb4
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
net/netfilter/nf_tables_api.c
View File

@@ -10874,6 +10874,10 @@ static void nft_set_commit_update(struct nft_ctx *ctx,
nft_ctx_update(ctx, trans);
switch (trans->msg_type) {
case NFT_MSG_DELSET:
case NFT_MSG_DESTROYSET:
nft_trans_set(trans)->dead = 1;
break;
case NFT_MSG_DELSETELEM:
te = nft_trans_container_elem(trans);
if (!te->set->ops->commit)