Re: [PATCH nf v2] netfilter: ipset: don't mask the element in place in mtype_test_cidrs()

[Florian Westphal]

Tamaki Yanagawa <ty@xxxxxxxxx> wrote:
> mtype_test_cidrs() masks the element under test in place with
> mtype_data_netmask() while walking the cidr array from the most to the
> least specific prefix. Since the walk is restarted on concurrent cidr
> array updates, the IPSET_NET_COUNT == 1 types (hash:net, hash:net,port,
> hash:ip,port,net, hash:net,iface) rescan with an element already masked
> to the widest prefix tried, so a lookup can wrongly match a more specific
> entry at the network base address (e.g. 10.200.3.4 matching 10.0.0.0/29).
> Work on a local copy of the element that is reinitialised on every scan
> instead.

LGTM.