path: root/kernel/net/netfilter/ipset/ip_set_core.c
diff options
authorRoss Lagerwall <>2017-09-27 10:06:27 +0100
committerJozsef Kadlecsik <>2017-09-28 12:29:56 +0200
commit99f04e60f5aec76c4ba6a4a0104ba2a5ae87e235 (patch)
tree7578ef75c46b2b356b562583e359a133d2059de5 /kernel/net/netfilter/ipset/ip_set_core.c
parenta8d545d85e8aeaa420051a7c1d504a72d455e077 (diff)
netfilter: ipset: Fix race between dump and swap
Fix a race between ip_set_dump_start() and ip_set_swap(). The race is as follows: * Without holding the ref lock, ip_set_swap() checks ref_netlink of the set and it is 0. * ip_set_dump_start() takes a reference on the set. * ip_set_swap() does the swap (even though it now has a non-zero reference count). * ip_set_dump_start() gets the set from ip_set_list again which is now a different set since it has been swapped. * ip_set_dump_start() calls __ip_set_put_netlink() and hits a BUG_ON due to the reference count being 0. Fix this race by extending the critical region in which the ref lock is held to include checking the ref counts. The race can be reproduced with the following script: while :; do ipset destroy hash_ip1 ipset destroy hash_ip2 ipset create hash_ip1 hash:ip family inet hashsize 1024 \ maxelem 500000 ipset create hash_ip2 hash:ip family inet hashsize 300000 \ maxelem 500000 ipset create hash_ip3 hash:ip family inet hashsize 1024 \ maxelem 500000 ipset save & ipset swap hash_ip3 hash_ip2 ipset destroy hash_ip3 wait done Signed-off-by: Ross Lagerwall <> Signed-off-by: Jozsef Kadlecsik <>
Diffstat (limited to 'kernel/net/netfilter/ipset/ip_set_core.c')
1 files changed, 5 insertions, 2 deletions
diff --git a/kernel/net/netfilter/ipset/ip_set_core.c b/kernel/net/netfilter/ipset/ip_set_core.c
index 5ff727a..32b7c0c 100644
--- a/kernel/net/netfilter/ipset/ip_set_core.c
+++ b/kernel/net/netfilter/ipset/ip_set_core.c
@@ -1203,14 +1203,17 @@ IPSET_CBFN(ip_set_swap, struct net *net, struct sock *ctnl,
from->family == to->family))
- if (from->ref_netlink || to->ref_netlink)
+ write_lock_bh(&ip_set_ref_lock);
+ if (from->ref_netlink || to->ref_netlink) {
+ write_unlock_bh(&ip_set_ref_lock);
return -EBUSY;
+ }
strncpy(from_name, from->name, IPSET_MAXNAMELEN);
strncpy(from->name, to->name, IPSET_MAXNAMELEN);
strncpy(to->name, from_name, IPSET_MAXNAMELEN);
- write_lock_bh(&ip_set_ref_lock);
swap(from->ref, to->ref);
ip_set(inst, from_id) = to;
ip_set(inst, to_id) = from;