Subject: Re: [syzbot] [netfilter?] possible deadlock in nf_tables_dumpreset_obj

From: Florian Westphal <[email-masked]>
Date: Tue, 23 Dec 2025 14:14:00 +0100

Jozsef Kadlecsik <[email-masked]> wrote:
> > Not yet sure how to avoid it.
> > Maybe we could get rid of 'lock(nfnl_subsys_ipset);'
> > from the xt_set module call paths.
> 
> I don't know how calling it could be avoided: userspace commands (ipset +
> iptables checkentry using ipset match/target) are serialized by
> nfnl_subsys_ipset.

Ok, thanks Jozsef.  In that case its much simpler to leave ipset
alone and add a new reset serialization mutex in nf_tables.