Re: [PATCH nf] netfilter: ipset: fix list type element drift bug

On Thu, 6 Aug 2026, Florian Westphal wrote:

> If list_set_uadd() calls list_set_replace() to swap an expired entry,
> the element count remains the same, therefore the increment must be elided.

Yes, well-spotted!

Acked-by: Jozsef Kadlecsik <[email protected]>

> Fixes: 702b71e7c666 ("netfilter: ipset: Add element count to all set types header")
> Link: https://sashiko.dev/#/patchset/20260806101947.2802-1-fw%40strlen.de
> Signed-off-by: Florian Westphal <[email protected]>
> ---
>  net/netfilter/ipset/ip_set_list_set.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
> index ca3ef9479e83..56626f4943a9 100644
> --- a/net/netfilter/ipset/ip_set_list_set.c
> +++ b/net/netfilter/ipset/ip_set_list_set.c
> @@ -301,8 +301,11 @@ list_set_uadd(struct ip_set *set, void *value, const struct ip_set_ext *ext,
>  	e->set = set;
>  	INIT_LIST_HEAD(&e->list);
>  	list_set_init_extensions(set, ext, e);
> -	if (n)
> +	if (n) {
>  		list_set_replace(set, e, n);
> +		return 0;
> +	}
> +
>  	else if (next)
>  		list_add_tail_rcu(&e->list, &next->list);
>  	else if (prev)
> -- 
> 2.54.0
> 
> 

-- 
E-mail : [email protected], [email protected], [email protected]
Address: Wigner Research Centre for Physics
         H-1525 Budapest 114, POB. 49, Hungary