Commit 3eb235a1 authored May 21, 2017 by Pablo Neira Ayuso Committed by Greg Kroah-Hartman Jun 14, 2017

netfilter: nft_set_rbtree: handle element re-addition after deletion



commit d2df92e98a34a5619dadd29c6291113c009181e7 upstream.

The existing code selects no next branch to be inspected when
re-inserting an inactive element into the rb-tree, looping endlessly.
This patch restricts the check for active elements to the EEXIST case
only.

Fixes: e701001e ("netfilter: nft_rbtree: allow adjacent intervals with dynamic updates")
Reported-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Tested-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent a8fc3159

net/netfilter/nft_set_rbtree.c

+11 −11

Original line number	Diff line number	Diff line
		@@ -118,17 +118,17 @@ static int __nft_rbtree_insert(const struct net net, const struct nft_set set,
		else if (d > 0)
		p = &parent->rb_right;
		else {
		if (nft_set_elem_active(&rbe->ext, genmask)) {
		if (nft_rbtree_interval_end(rbe) &&
		!nft_rbtree_interval_end(new))
		!nft_rbtree_interval_end(new)) {
		p = &parent->rb_left;
		else if (!nft_rbtree_interval_end(rbe) &&
		nft_rbtree_interval_end(new))
		} else if (!nft_rbtree_interval_end(rbe) &&
		nft_rbtree_interval_end(new)) {
		p = &parent->rb_right;
		else {
		} else if (nft_set_elem_active(&rbe->ext, genmask)) {
		*ext = &rbe->ext;
		return -EEXIST;
		}
		} else {
		p = &parent->rb_left;
		}
		}
		}