From 3f8369380859880807e5600cc8ff6ca42fb436a8 Mon Sep 17 00:00:00 2001 From: Brett Mastbergen Date: Mon, 31 Mar 2025 16:47:48 -0400 Subject: [PATCH] netfilter: nft_set_pipapo: skip inactive elements during set walk jira VULN-8903 cve CVE-2023-6817 commit-author Florian Westphal commit 317eb9685095678f2c9f5a8189de698c5354316a upstream-diff The change itself is the same as upstream, but there was a minor conflict in code surrounding the change because this kernel hasn't moved set element objects into the transaction yet. Otherwise set elements can be deactivated twice which will cause a crash. Reported-by: Xingyuan Mo Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso (cherry picked from commit 317eb9685095678f2c9f5a8189de698c5354316a) Signed-off-by: Brett Mastbergen --- net/netfilter/nft_set_pipapo.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 3f3ce6b9074b4..8446298cb641b 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1934,6 +1934,9 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, elem.priv = e; + if (!nft_set_elem_active(&e->ext, iter->genmask)) + goto cont; + iter->err = iter->fn(ctx, set, iter, &elem); if (iter->err < 0) goto out;