[RHEL7,COMMIT] ms/netfilter: nft_set_rbtree: handle element re-addition after deletion

Submitted by Vasily Averin on Dec. 20, 2020, 8:49 a.m.

Details

Message ID 202012200849.0BK8n1wk005106@vz7build.vvs.sw.ru
State New
Series "Series without cover letter"
Headers show

Commit Message

Vasily Averin Dec. 20, 2020, 8:49 a.m. 
The commit is pushed to "branch-rh7-3.10.0-1160.11.1.vz7.172.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1160.11.1.vz7.172.1
------>
commit e01449f8c9ba918c2c793242dd322d8f3cc3104e
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Sun Dec 20 11:49:01 2020 +0300

    ms/netfilter: nft_set_rbtree: handle element re-addition after deletion
    
    The existing code selects no next branch to be inspected when
    re-inserting an inactive element into the rb-tree, looping endlessly.
    This patch restricts the check for active elements to the EEXIST case
    only.
    
    Fixes: e701001e7cbe ("netfilter: nft_rbtree: allow adjacent intervals with dynamic updates")
    Reported-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
    Tested-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    (cherry-picked from commit d2df92e98a34a5619dadd29c6291113c009181e7)
    VvS: minor context changes
    https://jira.sw.ru/browse/PSBM-121318
    Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
---
 net/netfilter/nft_rbtree.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

Patch hide | download patch | download mbox 

diff --git a/net/netfilter/nft_rbtree.c b/net/netfilter/nft_rbtree.c
index ea06aa9..f9cfcf7 100644
--- a/net/netfilter/nft_rbtree.c
+++ b/net/netfilter/nft_rbtree.c
@@ -117,15 +117,16 @@  static int __nft_rbtree_insert(const struct nft_set *set,
 		else if (d > 0)
 			p = &parent->rb_right;
 		else {
-			if (nft_set_elem_active(&rbe->ext, genmask)) {
-				if (nft_rbtree_interval_end(rbe) &&
-				    !nft_rbtree_interval_end(new))
-					p = &parent->rb_left;
-				else if (!nft_rbtree_interval_end(rbe) &&
-					 nft_rbtree_interval_end(new))
-					p = &parent->rb_right;
-				else
-					return -EEXIST;
+			if (nft_rbtree_interval_end(rbe) &&
+			    !nft_rbtree_interval_end(new))
+				p = &parent->rb_left;
+			else if (!nft_rbtree_interval_end(rbe) &&
+				 nft_rbtree_interval_end(new))
+				p = &parent->rb_right;
+			else if (nft_set_elem_active(&rbe->ext, genmask)) {
+				return -EEXIST;
+			} else {
+				p = &parent->rb_left;
 			}
 		}
 	}