Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cf1c4a09 authored by Josh Hunt's avatar Josh Hunt Committed by Jozsef Kadlecsik
Browse files

netfilter: ipset: timeout values corrupted on set resize 



If a resize is triggered on a set with timeouts enabled, the timeout
values will get corrupted when copying them to the new set. This occured
b/c the wrong timeout value is supplied to type_pf_elem_tadd().

This also adds simple debug statement similar to the one in type_pf_resize().

Signed-off-by: default avatarJosh Hunt <johunt@akamai.com>
Signed-off-by: default avatarJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
parent e29371d7

include/linux/netfilter/ipset/ip_set_ahash.h

+3 −1
Original line number Original line Diff line number Diff line
@@ -854,6 +854,8 @@ type_pf_tresize(struct ip_set *set, bool retried) 
retry:

retry:

	ret = 0;

	ret = 0;

	htable_bits++;

	htable_bits++;

	pr_debug("attempt to resize set %s from %u to %u, t %p\n",

		 set->name, orig->htable_bits, htable_bits, orig);

	if (!htable_bits) {

	if (!htable_bits) {

		/* In case we have plenty of memory :-) */

		/* In case we have plenty of memory :-) */

		pr_warning("Cannot increase the hashsize of set %s further\n",

		pr_warning("Cannot increase the hashsize of set %s further\n",
@@ -873,7 +875,7 @@ type_pf_tresize(struct ip_set *set, bool retried) 
			data = ahash_tdata(n, j);

			data = ahash_tdata(n, j);

			m = hbucket(t, HKEY(data, h->initval, htable_bits));

			m = hbucket(t, HKEY(data, h->initval, htable_bits));

			ret = type_pf_elem_tadd(m, data, AHASH_MAX(h), 0,

			ret = type_pf_elem_tadd(m, data, AHASH_MAX(h), 0,

						type_pf_data_timeout(data));

						ip_set_timeout_get(type_pf_data_timeout(data)));

			if (ret < 0) {

			if (ret < 0) {

				read_unlock_bh(&set->lock);

				read_unlock_bh(&set->lock);

				ahash_destroy(t);

				ahash_destroy(t);