[lvc-project] [PATCH 6.1.y 0/2] netfilter: nft_set_pipapo: complete on-demand clone backport

[Denis Zubov]

This follows up on the thread about the stranded gc batch in the
backports of commit 9df95785d3d8 ("netfilter: nft_set_pipapo: split gc into
unlink and reclaim phase").

With the dirty flag still present, nft_pipapo_commit() can return
between pipapo_gc_scan() and pipapo_gc_queue(), leaving a batch on
priv->gc_head and triggering WARN_ON_ONCE() in nft_pipapo_destroy()
(panic with panic_on_warn).

Tested with a syzkaller reproducer: v6.1.188 hits the WARN, v6.1.188
with this series does not.

5.10.y is not affected (its backport already drains
the list unconditionally), 6.12.y and later have no dirty flag.

Florian Westphal (2):
  netfilter: nft_set_pipapo: prepare destroy function for on-demand
    clone
  netfilter: nft_set_pipapo: remove dirty flag

 net/netfilter/nft_set_pipapo.c | 52 ++++------------------------------
 net/netfilter/nft_set_pipapo.h |  2 --
 2 files changed, 6 insertions(+), 48 deletions(-)

-- 
2.53.0