From d94114685ef22b88feb07e2f6358b1992c983288 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Fri, 1 Dec 2023 15:47:13 +0100 Subject: [PATCH] netfilter: nft_set_pipapo: skip inactive elements during set walk stable inclusion from stable-v5.10.204~11 commit bf72b44fe81be08a9fcd58aabf417cd3337ffc99 category: bugfix issue: #I8RUB5 CVE: CVE-2023-6817 Signed-off-by: yaowenrui --------------------------------------- commit 317eb9685095678f2c9f5a8189de698c5354316a upstream. Otherwise set elements can be deactivated twice which will cause a crash. Reported-by: Xingyuan Mo Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman --- net/netfilter/nft_set_pipapo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index f67c4436c5d3..79f3cab1afd5 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1972,7 +1972,7 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, goto cont; e = f->mt[r].e; - if (nft_set_elem_expired(&e->ext)) + if (!nft_set_elem_active(&e->ext, iter->genmask)) goto cont; elem.priv = e; -- Gitee