Jozsef Kadlecsik says: ==================== ipset patches for nf Please apply the next patches for ipset in your nf branch. Both patches should go into the stable kernel branches as well, because these are important bugfixes: * Sometimes valid entries in hash:* types of sets were evicted due to a typo in an index. The wrong evictions happen when entries are deleted from the set and the bucket is shrinked. Bug was reported by Eric Ewanco and the patch fixes netfilter bugzilla id #1119. * Fixing of a null pointer exception when someone wants to add an entry to an empty list type of set and specifies an add before/after option. The fix is from Vishwanath Pai. ====================
Unified · Split
| @@ -897,7 +897,7 @@ mtype_del(struct ip_set *set, void *value, const struct ip_set_ext *ext, · 896 unmodified lines | ||
| 897 | 897 | continue; |
| 898 | 898 | data = ahash_data(n, j, dsize); |
| 899 | 899 | memcpy(tmp->value + k * dsize, data, dsize); |
| 900 | − set_bit(j, tmp->used); | |
| 900 | + set_bit(k, tmp->used); | |
| 901 | 901 | k++; |
| 902 | 902 | } |
| 903 | 903 | tmp->pos = k; |
| @@ -260,11 +260,14 @@ list_set_uadd(struct ip_set *set, void *value, const struct ip_set_ext *ext, · 259 unmodified lines | ||
| 260 | 260 | else |
| 261 | 261 | prev = e; |
| 262 | 262 | } |
| 263 | + | |
| 264 | + /* If before/after is used on an empty set */ | |
| 265 | + if ((d->before > 0 && !next) || | |
| 266 | + (d->before < 0 && !prev)) | |
| 267 | + return -IPSET_ERR_REF_EXIST; | |
| 268 | + | |
| 263 | 269 | /* Re-add already existing element */ |
| 264 | 270 | if (n) { |
| 265 | − if ((d->before > 0 && !next) || | |
| 266 | − (d->before < 0 && !prev)) | |
| 267 | − return -IPSET_ERR_REF_EXIST; | |
| 268 | 271 | if (!flag_exist) |
| 269 | 272 | return -IPSET_ERR_EXIST; |
| 270 | 273 | /* Update extensions */ |