Re: [PATCH] netfilter: nft_set_pipapo: skip transaction elements during GC

[Florian Westphal]

Bui Viet Dung <dungvn2345@xxxxxxxxx> wrote:
> Since nft_set_commit_update() runs set commit callbacks before processing
> NEWSETELEM transactions, pipapo_gc_scan() can observe elements added by
> the transaction being committed.
> 
> The scan evaluates elements in priv->clone without checking the element's
> transaction state. Expired elements are deactivated, dropped from
> priv->clone, and queued for GC reclaim via pipapo_gc_queue().
> 
> When the transaction loop in nf_tables_commit() subsequently processes
> NFT_MSG_NEWSETELEM, it calls nft_setelem_activate() on an element pointer
> that has already been handed off to GC reclaim, causing a
> slab-use-after-free.

Can you send a reproducer?  I don't understand how we can add
already-expired elements, it should not be permitted?