On Fri, 31 Jan 2020 20:24:23 +0100, Pablo Neira Ayuso wrote:

From: Kadlecsik József <redacted>

find_set_and_id() is called when the NFNL_SUBSYS_IPSET mutex is held.
However, in the error path there can be a follow-up recvmsg() without
the mutex held. Use the start() function of struct netlink_dump_control
instead of dump() to verify and report if the specified set does not
exist.

Thanks to Pablo Neira Ayuso for helping me to understand the subleties
of the netlink protocol.

Reported-by: syzbot+fc69d7cb21258ab4ae4d@syzkaller.appspotmail.com
Signed-off-by: Jozsef Kadlecsik <redacted>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

This will trigger a missing signed-off-by check:

Commit 5038517119d5 ("netfilter: ipset: fix suspicious RCU usage in find_set_and_id")
	author Signed-off-by missing
	author email:    kadlec@blackhole.kfki.hu
	committer email: pablo@netfilter.org
	Signed-off-by: Jozsef Kadlecsik [off-list ref]
	Signed-off-by: Pablo Neira Ayuso [off-list ref]

Problem is that the name differs by 'o' vs 'ó' (József Kadlecsik).

I wonder if it's worth getting rid of diacritics for the comparison..