From 6bcb1248cdcedc319ecf68ab8a17a69f1fab88fe Mon Sep 17 00:00:00 2001 From: Brett Mastbergen Date: Tue, 1 Apr 2025 13:24:45 -0400 Subject: [PATCH] netfilter: nft_set_pipapo: skip inactive elements during set walk jira VULN-4132 cve CVE-2023-6817 commit-author Florian Westphal commit 317eb9685095678f2c9f5a8189de698c5354316a upstream-diff The change itself is the same as upstream, but there was a minor conflict in code surrounding the change because this kernel hasn't moved set element objects into the transaction yet. Otherwise set elements can be deactivated twice which will cause a crash. Reported-by: Xingyuan Mo Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso (cherry picked from commit 317eb9685095678f2c9f5a8189de698c5354316a) Signed-off-by: Brett Mastbergen --- net/netfilter/nft_set_pipapo.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 452231e52d3fd..66a748c0d0c1a 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -1874,6 +1874,9 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, elem.priv = e; + if (!nft_set_elem_active(&e->ext, iter->genmask)) + goto cont; + iter->err = iter->fn(ctx, set, iter, &elem); if (iter->err < 0) goto out;