__ip_set_put_byindex() resolved the index to a set pointer under RCU,
then took ip_set_ref_lock in __ip_set_put() to decrement set->ref.
ip_set_swap() holds that same lock while swapping both the ip_set_list
slots and the two sets' ref counters, so it can interleave between the
dereference and the lock acquisition, leaving the caller to decrement a
set whose reference already moved to the other index and hit
BUG_ON(set->ref == 0). list_set_gc() reaches this from timer softirq,
which the nfnl mutex does not serialize against swap: an expiring
list:set member calls list_set_del() -> ip_set_put_byindex() while
IPSET_CMD_SWAP runs on the referenced sets.

Resolve the index and decrement under ip_set_ref_lock, as ip_set_swap()
already does, keeping the refcount tied to the index rather than to a
stale set pointer.

  kernel BUG at net/netfilter/ipset/ip_set_core.c:685!
  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:ip_set_put_byindex (net/netfilter/ipset/ip_set_core.c:870)
  Call Trace:
   <IRQ>
   list_set_del (net/netfilter/ipset/ip_set_list_set.c:159)
   set_cleanup_entries (net/netfilter/ipset/ip_set_list_set.c:181)
   list_set_gc (net/netfilter/ipset/ip_set_list_set.c:578)
   call_timer_fn (kernel/time/timer.c:1748)
   __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2374)
   run_timer_softirq (kernel/time/timer.c:2405)
   </IRQ>
  Kernel panic - not syncing: Fatal exception in interrupt

Fixes: 9076aea76538 ("netfilter: ipset: Increase the number of maximal sets automatically")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
---
 net/netfilter/ipset/ip_set_core.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index 6cfad152d7d1..16d33c3e28cf 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -679,11 +679,18 @@ __ip_set_get(struct ip_set *set)
 }
 
 static void
-__ip_set_put(struct ip_set *set)
+__ip_set_put_locked(struct ip_set *set)
 {
-	write_lock_bh(&ip_set_ref_lock);
+	lockdep_assert_held(&ip_set_ref_lock);
 	BUG_ON(set->ref == 0);
 	set->ref--;
+}
+
+static void
+__ip_set_put(struct ip_set *set)
+{
+	write_lock_bh(&ip_set_ref_lock);
+	__ip_set_put_locked(set);
 	write_unlock_bh(&ip_set_ref_lock);
 }
 
@@ -854,11 +861,11 @@ __ip_set_put_byindex(struct ip_set_net *inst, ip_set_id_t index)
 {
 	struct ip_set *set;
 
-	rcu_read_lock();
-	set = rcu_dereference(inst->ip_set_list)[index];
+	write_lock_bh(&ip_set_ref_lock);
+	set = ip_set(inst, index);
 	if (set)
-		__ip_set_put(set);
-	rcu_read_unlock();
+		__ip_set_put_locked(set);
+	write_unlock_bh(&ip_set_ref_lock);
 }
 
 void
-- 
2.43.0

On Wed, 22 Jul 2026, Xiang Mei (Microsoft) wrote:

> __ip_set_put_byindex() resolved the index to a set pointer under RCU,
> then took ip_set_ref_lock in __ip_set_put() to decrement set->ref.
> ip_set_swap() holds that same lock while swapping both the ip_set_list
> slots and the two sets' ref counters, so it can interleave between the
> dereference and the lock acquisition, leaving the caller to decrement a
> set whose reference already moved to the other index and hit
> BUG_ON(set->ref == 0). list_set_gc() reaches this from timer softirq,
> which the nfnl mutex does not serialize against swap: an expiring
> list:set member calls list_set_del() -> ip_set_put_byindex() while
> IPSET_CMD_SWAP runs on the referenced sets.
>
> Resolve the index and decrement under ip_set_ref_lock, as ip_set_swap()
> already does, keeping the refcount tied to the index rather than to a
> stale set pointer.
>
>  kernel BUG at net/netfilter/ipset/ip_set_core.c:685!
>  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
>  RIP: 0010:ip_set_put_byindex (net/netfilter/ipset/ip_set_core.c:870)
>  Call Trace:
>   <IRQ>
>   list_set_del (net/netfilter/ipset/ip_set_list_set.c:159)
>   set_cleanup_entries (net/netfilter/ipset/ip_set_list_set.c:181)
>   list_set_gc (net/netfilter/ipset/ip_set_list_set.c:578)
>   call_timer_fn (kernel/time/timer.c:1748)
>   __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2374)
>   run_timer_softirq (kernel/time/timer.c:2405)
>   </IRQ>
>  Kernel panic - not syncing: Fatal exception in interrupt
>
> Fixes: 9076aea76538 ("netfilter: ipset: Increase the number of maximal sets automatically")
> Reported-by: AutonomousCodeSecurity@microsoft.com
> Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>

Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>

Best regards,
Jozsef

> ---
> net/netfilter/ipset/ip_set_core.c | 19 +++++++++++++------
> 1 file changed, 13 insertions(+), 6 deletions(-)
>
> diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
> index 6cfad152d7d1..16d33c3e28cf 100644
> --- a/net/netfilter/ipset/ip_set_core.c
> +++ b/net/netfilter/ipset/ip_set_core.c
> @@ -679,11 +679,18 @@ __ip_set_get(struct ip_set *set)
> }
>
> static void
> -__ip_set_put(struct ip_set *set)
> +__ip_set_put_locked(struct ip_set *set)
> {
> -	write_lock_bh(&ip_set_ref_lock);
> +	lockdep_assert_held(&ip_set_ref_lock);
> 	BUG_ON(set->ref == 0);
> 	set->ref--;
> +}
> +
> +static void
> +__ip_set_put(struct ip_set *set)
> +{
> +	write_lock_bh(&ip_set_ref_lock);
> +	__ip_set_put_locked(set);
> 	write_unlock_bh(&ip_set_ref_lock);
> }
>
> @@ -854,11 +861,11 @@ __ip_set_put_byindex(struct ip_set_net *inst, ip_set_id_t index)
> {
> 	struct ip_set *set;
>
> -	rcu_read_lock();
> -	set = rcu_dereference(inst->ip_set_list)[index];
> +	write_lock_bh(&ip_set_ref_lock);
> +	set = ip_set(inst, index);
> 	if (set)
> -		__ip_set_put(set);
> -	rcu_read_unlock();
> +		__ip_set_put_locked(set);
> +	write_unlock_bh(&ip_set_ref_lock);
> }
>
> void
> -- 
> 2.43.0
>
>
>