Re: [PATCH nf] netfilter: ipset: restore element before rescanning cidrs on seqcount retry

[Tamaki Yanagawa]

Florian Westphal <fw@xxxxxxxxx> wrote:
> Is this a real world encountered bug or an LLM finding?

An LLM finding (Claude, hence the Assisted-by tag), I haven't hit it in
production. I did confirm it on a KVM guest though: a hash:net set with
10.0.0.0/29 and 11.0.0.0/8, an "iptables -m set --match-set s dst" rule,
a loop adding and deleting 172.16.0.0/12, and UDP traffic to 10.200.3.4.
70 out of ~9.5M packets matched the rule in 60 seconds without the fix,
none with it.

> Why do we need to do this instead of not masking @d in place to begin
> with?

No good reason, your version is cleaner. I'll send a v2 that works on a
local copy and constifies the reset_elem helpers.

Thanks,
Tamaki