Re: [PATCH nf] netfilter: nft_set_pipapo: skip transaction elements during GC

[Florian Westphal]

Joas Antonio dos Santos <joasantonio108@xxxxxxxxx> wrote:
> Since nft_set_commit_update() runs set commit callbacks before processing
> NEWSETELEM transactions, pipapo_gc_scan() can observe elements added by
> the transaction being committed: nft_pipapo_commit() calls
> pipapo_gc_scan() on the clone, which already holds the freshly inserted
> (not yet activated) elements.
> 
> pipapo_gc_scan() selects elements to collect using only
> __nft_set_elem_expired(), without checking the element's transaction
> state.  A new element that is already expired at commit time (for
> example a short expiration whose delta elapses during a large batch

Please ask your LLM to explain how a newly added element can be both new
and expired at the same time, then fix that.