Skip to content

Commit 317eb96

Browse files
Florian Westphalummakynes
Florian Westphal
authored andcommitted
netfilter: nft_set_pipapo: skip inactive elements during set walk
Otherwise set elements can be deactivated twice which will cause a crash. Reported-by: Xingyuan Mo <[email protected]> Fixes: 3c4287f ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]>
1 parent 1834d62 commit 317eb96

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

net/netfilter/nft_set_pipapo.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2043,6 +2043,9 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set,
20432043

20442044
e = f->mt[r].e;
20452045

2046+
if (!nft_set_elem_active(&e->ext, iter->genmask))
2047+
goto cont;
2048+
20462049
iter->err = iter->fn(ctx, set, iter, &e->priv);
20472050
if (iter->err < 0)
20482051
goto out;

0 commit comments

Comments
 (0)