netfilter: ipset: Add list flush to cancel_gc

Origin: https://git.kernel.org/linus/c1193d9bbbd379defe9be3c6de566de684de8a6f

Flushing list in cancel_gc drops references to other lists right away,
without waiting for RCU to destroy list. Fixes race when referenced
ipsets can't be destroyed while referring list is scheduled for destroy.

Fixes: 97f7cf1cd80e ("netfilter: ipset: fix performance regression in swap operation")
Signed-off-by: Alexander Maltsev <keltar.gw@gmail.com>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Gbp-Pq: Topic bugfix/all
Gbp-Pq: Name netfilter-ipset-Add-list-flush-to-cancel_gc.patch

diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index e839c356bcb56bf1ad23ab3252215b8905be3e70..902ff2f3bc72b539a9e1791281d0ca53eff608ff 100644 (file)
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -547,6 +547,9 @@ list_set_cancel_gc(struct ip_set *set)
 
        if (SET_WITH_TIMEOUT(set))
                del_timer_sync(&map->gc);
+
+       /* Flush list to drop references to other ipsets */
+       list_set_flush(set);
 }
 
 static const struct ip_set_type_variant set_variant = {