From: Jozsef Kadlecsik <kadlec@netfilter.org> mainline inclusion from mainline-v7.2-rc1 commit e4b4984e28c16406ecb318444dea4a8bf47def3e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17399 CVE: CVE-2026-72436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases - protected by region lock - in a set destroy phase - in a new/temporary set creation phase Fixes: 18f84d41d34f ("netfilter: ipset: Introduce RCU locking in hash:* types") Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Conflicts: net/netfilter/ipset/ip_set_hash_gen.h [context differences from mainline: f66ee0410b1c: resize still holds set->lock; mtype_ext_size() is absent. 7f7445840b77: bucket position accesses are not annotated. 8238b4579866: test_bit_acquire() is absent; use its generic acquire-load and bit-mask semantics at the three lockless readers.] Signed-off-by: Dong Chenchen <dongchenchen2@huawei.com> --- net/netfilter/ipset/ip_set_hash_gen.h | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h index 154b40f2f2a8..1cb7e5c1fc61 100644 --- a/net/netfilter/ipset/ip_set_hash_gen.h +++ b/net/netfilter/ipset/ip_set_hash_gen.h @@ -947,7 +947,9 @@ mtype_test_cidrs(struct ip_set *set, struct mtype_elem *d, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1002,7 +1004,9 @@ mtype_test(struct ip_set *set, void *value, const struct ip_set_ext *ext, goto out; } for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1128,7 +1132,9 @@ mtype_list(const struct ip_set *set, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; e = ahash_data(n, i, set->dsize); if (SET_WITH_TIMEOUT(set) && -- 2.43.0