Florian Westphal 9df95785d3 netfilter: nft_set_pipapo: split gc into unlink and reclaim phase ... Yiming Qian reports Use-after-free in the pipapo set type: Under a large number of expired elements, commit-time GC can run for a very long time in a non-preemptible context, triggering soft lockup warnings and RCU stall reports (local denial of service). We must split GC in an unlink and a reclaim phase. We cannot queue elements for freeing until pointers have been swapped. Expired elements are still exposed to both the packet path and userspace dumpers via the live copy of the data structure. call_rcu() does not protect us: dump operations or element lookups starting after call_rcu has fired can still observe the free'd element, unless the commit phase has made enough progress to swap the clone and live pointers before any new reader has picked up the old version. This a similar approach as done recently for the rbtree backend in commit 35f83a7552 ("netfilter: nft_set_rbtree: don't gc elements on insert"). Fixes: 3c4287f620 ("nf_tables: Add set type for arbitrary concatenation of ranges") Reported-by: Yiming Qian <yimingqian591@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>		2026-03-05 13:22:37 +01:00
..
ipv4	netfilter: nf_reject: remove unneeded exports	2025-09-02 15:28:17 +02:00
ipv6	netfilter: nf_reject: remove unneeded exports	2025-09-02 15:28:17 +02:00
br_netfilter.h	netfilter: remove CONFIG_NETFILTER checks from headers.	2019-09-13 12:47:36 +02:00
nf_bpf_link.h	bpf: minimal support for programs hooked into netfilter framework	2023-04-21 11:34:14 -07:00
nf_conntrack.h	netfilter: nf_conntrack: don't rely on implicit includes	2026-01-20 16:23:37 +01:00
nf_conntrack_acct.h	netfilter: conntrack: Remove unused function declarations	2023-08-08 13:02:00 +02:00
nf_conntrack_act_ct.h	net/sched: act_ct: Always fill offloading tuple iifidx	2023-11-08 17:47:08 -08:00
nf_conntrack_bpf.h	net: netfilter: move bpf_ct_set_nat_info kfunc in nf_nat_bpf.c	2022-10-03 09:17:32 -07:00
nf_conntrack_bridge.h	netfilter: remove CONFIG_NETFILTER checks from headers.	2019-09-13 12:47:36 +02:00
nf_conntrack_core.h	netfilter: conntrack: fix wrong ct->timeout value	2023-04-19 12:08:38 +02:00
nf_conntrack_count.h	netfilter: nf_conncount: increase the connection clean up limit to 64	2026-01-20 16:23:37 +01:00
nf_conntrack_ecache.h	netfilter: conntrack: add conntrack event timestamp	2025-01-09 14:42:16 +01:00
nf_conntrack_expect.h	netfilter: allow exp not to be removed in nf_ct_find_expectation	2023-07-20 10:06:36 +02:00
nf_conntrack_extend.h	netfilter: extensions: introduce extension genid count	2022-05-13 18:52:16 +02:00
nf_conntrack_helper.h	netfilter: helper: Remove unused function declarations	2023-08-08 13:01:59 +02:00
nf_conntrack_l4proto.h	netfilter: fix typo in nf_conntrack_l4proto.h comment	2025-10-30 12:52:45 +01:00
nf_conntrack_labels.h	netfilter: conntrack: switch connlabels to atomic_t	2023-10-24 13:16:30 +02:00
nf_conntrack_seqadj.h	netfilter: conntrack: remove extension register api	2022-02-04 06:30:28 +01:00
nf_conntrack_synproxy.h	netfilter: conntrack: wrap two inline functions in config checks.	2019-09-13 12:47:10 +02:00
nf_conntrack_timeout.h	netfilter: nf_conntrack: add missing __rcu annotations	2022-07-11 16:25:15 +02:00
nf_conntrack_timestamp.h	netfilter: conntrack: remove extension register api	2022-02-04 06:30:28 +01:00
nf_conntrack_tuple.h	netfilter: don't include xt and nftables.h in unrelated subsystems	2026-01-20 16:23:37 +01:00
nf_conntrack_zones.h	netfilter: conntrack: remove CONFIG_NF_CONNTRACK checks from nf_conntrack_zones.h.	2019-09-13 12:47:41 +02:00
nf_dup_netdev.h	netfilter: nft_{fwd,dup}_netdev: add offload support	2019-09-10 22:44:29 +02:00
nf_flow_table.h	netfilter: flowtable: Add IPIP rx sw acceleration	2025-11-28 00:00:38 +00:00
nf_hooks_lwtunnel.h	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
nf_log.h	netfilter: load nf_log_syslog on enabling nf_conntrack_log_invalid	2025-07-25 18:35:41 +02:00
nf_nat.h	net: move the nat function to nf_nat_ovs for ovs and tc	2022-12-12 10:14:03 +00:00
nf_nat_helper.h	netfilter: nat: move repetitive nat port reserve loop to a helper	2022-09-07 16:46:04 +02:00
nf_nat_masquerade.h	netfilter: update include directives.	2019-09-13 12:33:06 +02:00
nf_nat_redirect.h	netfilter: nft_redir: use struct nf_nat_range2 throughout and deduplicate eval call-backs	2023-03-22 21:48:59 +01:00
nf_queue.h	netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation	2026-02-06 13:34:55 +01:00
nf_reject.h	netfilter: conntrack: remove DCCP protocol support	2025-07-03 13:51:39 +02:00
nf_socket.h
nf_synproxy.h	netfilter: remove CONFIG_NETFILTER checks from headers.	2019-09-13 12:47:36 +02:00
nf_tables.h	netfilter: nft_set_pipapo: split gc into unlink and reclaim phase	2026-03-05 13:22:37 +01:00
nf_tables_core.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2025-09-11 17:40:13 -07:00
nf_tables_ipv4.h	netfilter: nf_tables: restore IP sanity checks for netdev/egress	2024-08-26 13:05:28 +02:00
nf_tables_ipv6.h	net/ipv6: Introduce payload_len helpers	2026-02-06 20:50:03 -08:00
nf_tables_offload.h	netfilter: nf_tables: bail out early if hardware offload is not supported	2022-06-06 19:19:15 +02:00
nf_tproxy.h	net: reformat kdoc return statements	2024-12-09 14:44:59 -08:00
nft_fib.h	netfilter: nf_tables: nft_fib: consistent l3mdev handling	2025-05-23 13:57:09 +02:00
nft_meta.h	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
nft_reject.h	netfilter: nf_tables: drop unused 3rd argument from validate callback ops	2024-09-03 10:47:17 +02:00
xt_rateest.h	net: sched: Merge Qdisc::bstats and Qdisc::cpu_bstats data types	2021-10-18 12:54:41 +01:00