netfilter: nf_tables: set on dead bit when performing early element removal

.commit call for sets is skipped if set->dead flag is set on, but this
flag is set on later in the commit path.

This also reintroduces the bug fixed in commit 7315dc1e122c8
("netfilter: nf_tables: skip set commit for deleted/destroyed sets").

Fixes: 1e3b9e1c77fe ("netfilter: nf_tables: call set ops .commit when building new ruleset blob")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 20c562174b278b93de62485833da7592ffde87e5..9b776f402d14fd32f8816d083128eb588ee81b10 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -10874,6 +10874,10 @@ static void nft_set_commit_update(struct nft_ctx *ctx,
                nft_ctx_update(ctx, trans);
 
                switch (trans->msg_type) {
+               case NFT_MSG_DELSET:
+               case NFT_MSG_DESTROYSET:
+                       nft_trans_set(trans)->dead = 1;
+                       break;
                case NFT_MSG_DELSETELEM:
                        te = nft_trans_container_elem(trans);
                        if (!te->set->ops->commit)