netfilter: nf_tables: check if catch-all set element is active in next generation
authorPablo Neira Ayuso <pablo@netfilter.org>
Fri, 12 Jan 2024 22:28:45 +0000 (23:28 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 17 Jan 2024 11:02:49 +0000 (12:02 +0100)
commitb1db244ffd041a49ecc9618e8feb6b5c1afcdaa7
treeaa04b409ad83be3028a7ea2a8cf58e93e97b004a
parent9874808878d9eed407e3977fd11fee49de1e1d86
netfilter: nf_tables: check if catch-all set element is active in next generation

When deactivating the catch-all set element, check the state in the next
generation that represents this transaction.

This bug uncovered after the recent removal of the element busy mark
a2dd0233cbc4 ("netfilter: nf_tables: remove busy mark and gc batch API").

Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support")
Cc: stable@vger.kernel.org
Reported-by: lonial con <kongln9170@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_tables_api.c