set .destroy callback releases the references to other objects in maps.
This is very late and it results in spurious EBUSY errors. Drop refcount
from the preparation phase instead, update set backend not to drop
reference counter from set .destroy path.
Exceptions: NFT_TRANS_PREPARE_ERROR does not require to drop the
reference counter because the transaction abort path releases the map
references for each element since the set is unbound. The abort path
also deals with releasing reference counter for new elements added to
unbound sets.
Fixes: 591054469b3e ("netfilter: nf_tables: revisit chain/object refcounting from elements")
Signed-off-by: Pablo Neira Ayuso <email address hidden>
(backported from commit 628bd3e49cba1c066228e23d71a852c23e26da73)
[bzolnier: backported changes for net/netfilter/nft_set_pipapo.c which is
not present in the generic Ubuntu kernel]
Signed-off-by: Bartlomiej Zolnierkiewicz <email address hidden>
704dca1...
by
Pablo Neira Ayuso <email address hidden>
netfilter: nf_tables: adapt set backend to use GC transaction API
Use the GC transaction API to replace the old and buggy gc API and the
busy mark approach.
No set elements are removed from async garbage collection anymore,
instead the _DEAD bit is set on so the set element is not visible from
lookup path anymore. Async GC enqueues transaction work that might be
aborted and retried later.
rbtree and pipapo set backends does not set on the _DEAD bit from the
sync GC path since this runs in control plane path where mutex is held.
In this case, set elements are deactivated, removed and then released
via RCU callback, sync GC never fails.
Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Fixes: 8d8540c4f5e0 ("netfilter: nft_set_rbtree: add timeout support")
Fixes: 9d0982927e79 ("netfilter: nft_hash: add support for timeouts")
Signed-off-by: Pablo Neira Ayuso <email address hidden>
(backported from commit f6c383b8c31a93752a52697f8430a71dcbc46adf)
[bzolnier: backported changes for net/netfilter/nft_set_pipapo.c which is
not present in the generic Ubuntu kernel]
Signed-off-by: Bartlomiej Zolnierkiewicz <email address hidden>
