[Devel] [PATCH VZ7 4/7] netfilter: ipset: Add list flush to cancel_gc

[Pavel Tikhomirov]

From: Alexander Maltsev <keltar.gw at gmail.com>

Flushing list in cancel_gc drops references to other lists right away,
without waiting for RCU to destroy list. Fixes race when referenced
ipsets can't be destroyed while referring list is scheduled for destroy.

Fixes: 97f7cf1cd80e ("netfilter: ipset: fix performance regression in swap operation")
Signed-off-by: Alexander Maltsev <keltar.gw at gmail.com>
Acked-by: Jozsef Kadlecsik <kadlec at netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo at netfilter.org>

https://virtuozzo.atlassian.net/browse/PSBM-155867
(cherry picked from commit c1193d9bbbd379defe9be3c6de566de684de8a6f)
Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
---
 net/netfilter/ipset/ip_set_list_set.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
index b9dc3063e0d44..dd0fa9ada492d 100644
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -553,6 +553,9 @@ list_set_cancel_gc(struct ip_set *set)
 
 	if (SET_WITH_TIMEOUT(set))
 		del_timer_sync(&map->gc);
+
+	/* Flush list to drop references to other ipsets */
+	list_set_flush(set);
 }
 
 static const struct ip_set_type_variant set_variant = {
-- 
2.46.0