[RHEL7,COMMIT] ms/netfilter: nft_set_rbtree: check for inactive element after flag mismatch

Submitted by Vasily Averin on Dec. 20, 2020, 8:49 a.m.

Details

Message ID 202012200849.0BK8n8vF005199@vz7build.vvs.sw.ru
State New
Series "Series without cover letter"
Headers show

Commit Message

Vasily Averin Dec. 20, 2020, 8:49 a.m. 
The commit is pushed to "branch-rh7-3.10.0-1160.11.1.vz7.172.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1160.11.1.vz7.172.1
------>
commit b1576d1ed4136a204f146948fb80672ee84a6484
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Sun Dec 20 11:49:08 2020 +0300

    ms/netfilter: nft_set_rbtree: check for inactive element after flag mismatch
    
    Otherwise, we hit bogus ENOENT when removing elements.
    
    Fixes: e701001e7cbe ("netfilter: nft_rbtree: allow adjacent intervals with dynamic updates")
    Reported-by: Václav Zindulka <vaclav.zindulka@tlapnet.cz>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    
    (cherry-picked from commit 05b7639da55f5555b9866a1f4b7e8995232a6323)
    VvS: minor context changes
    https://jira.sw.ru/browse/PSBM-121318
    Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
---
 net/netfilter/nft_rbtree.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

Patch hide | download patch | download mbox 

diff --git a/net/netfilter/nft_rbtree.c b/net/netfilter/nft_rbtree.c
index f9cfcf7..ab95e57 100644
--- a/net/netfilter/nft_rbtree.c
+++ b/net/netfilter/nft_rbtree.c
@@ -194,10 +194,6 @@  static void *nft_rbtree_deactivate(const struct nft_set *set,
 		else if (d > 0)
 			parent = parent->rb_right;
 		else {
-			if (!nft_set_elem_active(&rbe->ext, genmask)) {
-				parent = parent->rb_left;
-				continue;
-			}
 			if (nft_rbtree_interval_end(rbe) &&
 			    !nft_rbtree_interval_end(this)) {
 				parent = parent->rb_left;
@@ -206,6 +202,9 @@  static void *nft_rbtree_deactivate(const struct nft_set *set,
 				   nft_rbtree_interval_end(this)) {
 				parent = parent->rb_right;
 				continue;
+			} else if (!nft_set_elem_active(&rbe->ext, genmask)) {
+				parent = parent->rb_left;
+				continue;
 			}
 			nft_rbtree_deactivate_one(set, rbe);
 			return rbe;