Re: [PATCH nf 1/1] netfilter: ipset: serialize kernel-side put-byindex with swap

Zhiling Zou [off-list ref] wrote:

list:set garbage collection drops member set references through
ip_set_put_byindex(), which resolves inst->ip_set_list[index] before
__ip_set_put() takes ip_set_ref_lock. ip_set_swap() swaps both the set
pointers and the corresponding refcounts while holding that same lock.

If garbage collection looks up the old set pointer for an index and then
loses the lock race to ip_set_swap(), it decrements the old object after
its refcount has already been swapped away. This can trigger BUG_ON(ref
== 0) when the other set had no references, or otherwise under-reference
a set that is still reachable through the swapped index.

Fix this by holding ip_set_ref_lock across the kernel-side lookup and
refcount decrement. This keeps ip_set_put_byindex() paired with the same
set/ref state that ip_set_swap() publishes, without changing normal
list:set deletion or swap behaviour.

Looks like a duplicate of
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260722223832.3524006-1-xmei5@asu.edu/