Re: [PATCH net] netfilter: ipset: list:set: defer ip_set_put_byindex to RCU callback

"Cen Zhang (Microsoft)" <[email protected]> Wed, 19 Aug 2026 23:43:17 -0400

Newsgroups	gmane.comp.security.firewalls.netfilter.devel,gmane.linux.kernel,gmane.linux.network
Message-ID	<[email protected]>

Hi Xuanqiang,

Thanks for the review. You're right that this effectively restores the
stale-refcount window fixed by 439cd39ea136. I was aware of that
trade-off, but focused first on preventing the kernel BUG that can be
triggered by an unprivileged user. I agree that the final fix should
address both issues.

I'll rework the fix and send a v2.

Suggestions on the preferred approach are welcome.

Thanks,
Cen