netfilter: nft_set_rbtree: .deactivate fails if element has expired
authorPablo Neira Ayuso <pablo@netfilter.org>
Tue, 17 Oct 2023 10:28:27 +0000 (12:28 +0200)
committerFlorian Westphal <fw@strlen.de>
Wed, 18 Oct 2023 11:47:32 +0000 (13:47 +0200)
This allows to remove an expired element which is not possible in other
existing set backends, this is more noticeable if gc-interval is high so
expired elements remain in the tree. On-demand gc also does not help in
this case, because this is delete element path. Return NULL if element
has expired.

Fixes: 8d8540c4f5e0 ("netfilter: nft_set_rbtree: add timeout support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
net/netfilter/nft_set_rbtree.c

index 2660cea..e34662f 100644 (file)
@@ -568,6 +568,8 @@ static void *nft_rbtree_deactivate(const struct net *net,
                                   nft_rbtree_interval_end(this)) {
                                parent = parent->rb_right;
                                continue;
+                       } else if (nft_set_elem_expired(&rbe->ext)) {
+                               break;
                        } else if (!nft_set_elem_active(&rbe->ext, genmask)) {
                                parent = parent->rb_left;
                                continue;