Re: [PATCH nf 1/1] netfilter: ipset: serialize kernel-side put-byindex with swap

Zhiling Zou <[email protected]> wrote:
> list:set garbage collection drops member set references through
> ip_set_put_byindex(), which resolves inst->ip_set_list[index] before
> __ip_set_put() takes ip_set_ref_lock. ip_set_swap() swaps both the set
> pointers and the corresponding refcounts while holding that same lock.
> 
> If garbage collection looks up the old set pointer for an index and then
> loses the lock race to ip_set_swap(), it decrements the old object after
> its refcount has already been swapped away. This can trigger BUG_ON(ref
> == 0) when the other set had no references, or otherwise under-reference
> a set that is still reachable through the swapped index.
> 
> Fix this by holding ip_set_ref_lock across the kernel-side lookup and
> refcount decrement. This keeps ip_set_put_byindex() paired with the same
> set/ref state that ip_set_swap() publishes, without changing normal
> list:set deletion or swap behaviour.

Looks like a duplicate of
https://patchwork.ozlabs.org/project/netfilter-devel/patch/[email protected]/