From nobody Mon May 25 03:09:14 2026 Received: from n169-112.mail.139.com (n169-112.mail.139.com [120.232.169.112]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8CAB619644B; Tue, 19 May 2026 07:55:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=120.232.169.112 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779177330; cv=none; b=qIQSbVPUztRoOGebI10tgZXv+F3Qrzvsib6DDSEM0rXYwq7wtEeeALQXNh3LjjJfegKi5dgCAnWAze4jeZDunRpH1P25krzR5L/u1FGd9X7HxVnlJ9N5N1yp5AI0I5NEHpee72TIARFHimM3/SVRPAIkhTlmcaMYwe/QZ7EGALM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779177330; c=relaxed/simple; bh=hvwJY0zgagSKeFkymx3E5hGWKUTh3knZ/BDqdUWZXUE=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=bO10K3QPW6oRVhmMBF6I9V0EH7JTyuGJB9jl8ZNZDHU0MCVov20RWKM1nW5aZQQC76LJjxjuP2Eaa5P1FCFMPuCtg0EBNV0t1lIWAbXH5q58NM6EkB0dkMf2100/LdYmaZU4PAV5jUz1UwK7HOYfteorsRhI2wRftyTepY7O0gs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=139.com; spf=pass smtp.mailfrom=139.com; dkim=pass (1024-bit key) header.d=139.com header.i=@139.com header.b=2F1K0J3s; arc=none smtp.client-ip=120.232.169.112 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=139.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=139.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=139.com header.i=@139.com header.b="2F1K0J3s" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=139.com; s=dkim; l=0; h=from:subject:message-id:to:cc:mime-version; bh=47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=; b=2F1K0J3s1Gokcf+pR4XKMSorKna0Hh8p9Vfw3WOKT6kK61i1omLfMb2Tvygm6395iXfFiTCmRKpsl 8IqYSxCAX9MLGuqhWliSzXf4XZ/wtlyKz3QPfNhsvw/i8Mgbkpw80NxHD50VwPIf+1vFg7XihRLIrG i7mX0xWx8bktkbrQ= X-RM-TagInfo: emlType=0 X-RM-SPAM: X-RM-SPAM-FLAG: 00000000 Received: from NTT-kernel-dev (unknown[60.247.85.88]) by rmsmtp-lg-appmail-24-12027 (RichMail) with SMTP id 2efb6a0c17611ba-021e2; Tue, 19 May 2026 15:55:19 +0800 (CST) X-RM-TRANSID: 2efb6a0c17611ba-021e2 From: Li hongliang <1468888505@139.com> To: gregkh@linuxfoundation.org, stable@vger.kernel.org, pablo@netfilter.org Cc: patches@lists.linux.dev, linux-kernel@vger.kernel.org, kadlec@netfilter.org, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, netdev@vger.kernel.org, y0un9sa@gmail.com, fw@strlen.de Subject: [PATCH 6.6.y] netfilter: nf_tables: unconditionally bump set->nelems before insertion Date: Tue, 19 May 2026 15:55:18 +0800 Message-Id: <20260519075518.2106753-1-1468888505@139.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Pablo Neira Ayuso [ Upstream commit def602e498a4f951da95c95b1b8ce8ae68aa733a ] In case that the set is full, a new element gets published then removed without waiting for the RCU grace period, while RCU reader can be walking over it already. To address this issue, add the element transaction even if set is full, but toggle the set_full flag to report -ENFILE so the abort path safely unwinds the set to its previous state. As for element updates, decrement set->nelems to restore it. A simpler fix is to call synchronize_rcu() in the error path. However, with a large batch adding elements to already maxed-out set, this could cause noticeable slowdown of such batches. Fixes: 35d0ac9070ef ("netfilter: nf_tables: fix set->nelems counting with n= o NLM_F_EXCL") Reported-by: Inseo An Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal [ Minor conflict resolved. ] Signed-off-by: Li hongliang <1468888505@139.com> --- net/netfilter/nf_tables_api.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index a0914a92e07d..6fc88bf51109 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -6803,6 +6803,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, stru= ct nft_set *set, struct nft_data_desc desc; enum nft_registers dreg; struct nft_trans *trans; + bool set_full =3D false; u64 timeout; u64 expiration; int err, i; @@ -7095,10 +7096,18 @@ static int nft_add_set_elem(struct nft_ctx *ctx, st= ruct nft_set *set, if (err < 0) goto err_elem_free; =20 + if (!(flags & NFT_SET_ELEM_CATCHALL)) { + unsigned int max =3D nft_set_maxsize(set), nelems; + + nelems =3D atomic_inc_return(&set->nelems); + if (nelems > max) + set_full =3D true; + } + trans =3D nft_trans_elem_alloc(ctx, NFT_MSG_NEWSETELEM, set); if (trans =3D=3D NULL) { err =3D -ENOMEM; - goto err_elem_free; + goto err_set_size; } =20 ext->genmask =3D nft_genmask_cur(ctx->net); @@ -7130,23 +7139,16 @@ static int nft_add_set_elem(struct nft_ctx *ctx, st= ruct nft_set *set, goto err_element_clash; } =20 - if (!(flags & NFT_SET_ELEM_CATCHALL)) { - unsigned int max =3D nft_set_maxsize(set); - - if (!atomic_add_unless(&set->nelems, 1, max)) { - err =3D -ENFILE; - goto err_set_full; - } - } - nft_trans_elem(trans) =3D elem; nft_trans_commit_list_add_tail(ctx->net, trans); - return 0; =20 -err_set_full: - nft_setelem_remove(ctx->net, set, &elem); + return set_full ? -ENFILE : 0; + err_element_clash: kfree(trans); +err_set_size: + if (!(flags & NFT_SET_ELEM_CATCHALL)) + atomic_dec(&set->nelems); err_elem_free: nf_tables_set_elem_destroy(ctx, set, elem.priv); err_parse_data: --=20 2.34.1