Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fdad255b authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso Committed by Greg Kroah-Hartman
Browse files

netfilter: nft_set_rbtree: check for inactive element after flag mismatch 



[ Upstream commit 05b7639da55f5555b9866a1f4b7e8995232a6323 ]

Otherwise, we hit bogus ENOENT when removing elements.

Fixes: e701001e ("netfilter: nft_rbtree: allow adjacent intervals with dynamic updates")
Reported-by: default avatarVáclav Zindulka <vaclav.zindulka@tlapnet.cz>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarSasha Levin (Microsoft) <sashal@kernel.org>
parent 74a9e727

net/netfilter/nft_set_rbtree.c

+3 −4
Original line number Original line Diff line number Diff line
@@ -224,10 +224,6 @@ static void *nft_rbtree_deactivate(const struct net *net, 
		else if (d > 0)

		else if (d > 0)

			parent = parent->rb_right;

			parent = parent->rb_right;

		else {

		else {

			if (!nft_set_elem_active(&rbe->ext, genmask)) {

				parent = parent->rb_left;

				continue;

			}

			if (nft_rbtree_interval_end(rbe) &&

			if (nft_rbtree_interval_end(rbe) &&

			    !nft_rbtree_interval_end(this)) {

			    !nft_rbtree_interval_end(this)) {

				parent = parent->rb_left;

				parent = parent->rb_left;
@@ -236,6 +232,9 @@ static void *nft_rbtree_deactivate(const struct net *net, 
				   nft_rbtree_interval_end(this)) {

				   nft_rbtree_interval_end(this)) {

				parent = parent->rb_right;

				parent = parent->rb_right;

				continue;

				continue;

			} else if (!nft_set_elem_active(&rbe->ext, genmask)) {

				parent = parent->rb_left;

				continue;

			}

			}

			nft_rbtree_flush(net, set, rbe);

			nft_rbtree_flush(net, set, rbe);

			return rbe;

			return rbe;