* Re: [PATCH net 04/11] netfilter: revert nft_set_rbtree: validate open interval overlap: manual merge
[not found] ` <20260313150614.21177-5-fw@strlen.de>
@ 2026-03-16 8:14 ` Matthieu Baerts
0 siblings, 0 replies; only message in thread
From: Matthieu Baerts @ 2026-03-16 8:14 UTC (permalink / raw)
To: Florian Westphal, netdev
Cc: Paolo Abeni, David S. Miller, Eric Dumazet, Jakub Kicinski,
netfilter-devel, pablo, linux-next, Mark Brown
Hi Florian,
(+cc linux-next)
On 13/03/2026 16:06, Florian Westphal wrote:
> This reverts commit 648946966a08 ("netfilter: nft_set_rbtree: validate
> open interval overlap").
>
> There have been reports of nft failing to laod valid rulesets after this
> patch was merged into -stable.
>
> I can reproduce several such problem with recent nft versions, including
> nft 1.1.6 which is widely shipped by distributions.
>
> We currently have little choice here.
> This commit can be resurrected at some point once the nftables fix that
> triggers the false overlap positive has appeared in common distros
> (see e83e32c8d1cd ("mnl: restore create element command with large batches" in
> nftables.git).
FYI, we got a small conflict when merging 'net' in 'net-next' in the
MPTCP tree due to this patch applied in 'net':
598adea720b9 ("netfilter: revert nft_set_rbtree: validate open interval overlap")
and this one from 'net-next':
3aea466a4399 ("netfilter: nft_set_rbtree: don't disable bh when acquiring tree lock")
(...)
> diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
> index ee3d4f5b9ff7..fe8bd497d74a 100644
> --- a/net/netfilter/nft_set_rbtree.c
> +++ b/net/netfilter/nft_set_rbtree.c
(...)
> @@ -685,12 +640,8 @@ static int nft_rbtree_insert(const struct net *net, const struct nft_set *set,
> cond_resched();
>
> write_lock_bh(&priv->lock);
> - err = __nft_rbtree_insert(net, set, rbe, elem_priv, tstamp, last);
> + err = __nft_rbtree_insert(net, set, rbe, elem_priv, tstamp);
> write_unlock_bh(&priv->lock);
The conflict was in the context: the patch in "net-next" stop disabling
bh, modifying the two write_(un)lock_bh() calls, while here the code
executed with the lock and just after is modified.
Rerere cache is available in [1]. The patch is attached below.
Cheers,
Matt
1: https://github.com/multipath-tcp/mptcp-upstream-rr-cache/commit/a0ec8d0
-------------------- 8< --------------------
diff --cc net/netfilter/nft_set_rbtree.c
index e42905376654,fe8bd497d74a..b7501b2b873e
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@@ -684,13 -639,9 +639,9 @@@ static int nft_rbtree_insert(const stru
cond_resched();
- write_lock_bh(&priv->lock);
+ write_lock(&priv->lock);
- err = __nft_rbtree_insert(net, set, rbe, elem_priv, tstamp, last);
+ err = __nft_rbtree_insert(net, set, rbe, elem_priv, tstamp);
- write_unlock_bh(&priv->lock);
+ write_unlock(&priv->lock);
-
- if (nft_rbtree_interval_end(rbe))
- priv->start_rbe_cookie = 0;
-
} while (err == -EAGAIN);
return err;
-------------------- 8< --------------------
--
Sponsored by the NGI0 Core fund.
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-03-16 8:14 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20260313150614.21177-1-fw@strlen.de>
[not found] ` <20260313150614.21177-5-fw@strlen.de>
2026-03-16 8:14 ` [PATCH net 04/11] netfilter: revert nft_set_rbtree: validate open interval overlap: manual merge Matthieu Baerts
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox