diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2023-10-17 12:28:27 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2023-10-18 13:47:32 +0200 |
| commit | d111692a59c1470ae530cbb39bcf0346c950ecc7 (patch) | |
| tree | db4af3448bb7195be055a3c5a4566fb66e862964 /net/netfilter | |
| parent | selftests: netfilter: Run nft_audit.sh in its own netns (diff) | |
| download | linux-d111692a59c1470ae530cbb39bcf0346c950ecc7.tar.xz linux-d111692a59c1470ae530cbb39bcf0346c950ecc7.zip | |
netfilter: nft_set_rbtree: .deactivate fails if element has expired
This allows to remove an expired element which is not possible in other
existing set backends, this is more noticeable if gc-interval is high so
expired elements remain in the tree. On-demand gc also does not help in
this case, because this is delete element path. Return NULL if element
has expired.
Fixes: 8d8540c4f5e0 ("netfilter: nft_set_rbtree: add timeout support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/nft_set_rbtree.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c index 2660ceab3759..e34662f4a71e 100644 --- a/net/netfilter/nft_set_rbtree.c +++ b/net/netfilter/nft_set_rbtree.c @@ -568,6 +568,8 @@ static void *nft_rbtree_deactivate(const struct net *net, nft_rbtree_interval_end(this)) { parent = parent->rb_right; continue; + } else if (nft_set_elem_expired(&rbe->ext)) { + break; } else if (!nft_set_elem_active(&rbe->ext, genmask)) { parent = parent->rb_left; continue; |