nft_rbtree_gc_queue() passes the result of nft_trans_gc_catchall_sync() straight to nft_trans_gc_queue_sync_done(). When the catchall path flushes a full GC batch and nft_trans_gc_alloc() fails, catchall_sync returns NULL and queue_sync_done dereferences trans->net (NULL+0x10). Guard the call like the pipapo GC path already does. Fixes: 7d259f021aaa ("netfilter: nft_set_rbtree: prefer sync gc to async worker") Assisted-by: opencode:deepseek-v4 Signed-off-by: Xingyuan Mo --- net/netfilter/nft_set_rbtree.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c index 12431b55752f..4338921bd88f 100644 --- a/net/netfilter/nft_set_rbtree.c +++ b/net/netfilter/nft_set_rbtree.c @@ -953,7 +953,8 @@ static void nft_rbtree_gc_queue(struct nft_set *set) } gc = nft_trans_gc_catchall_sync(gc); - nft_trans_gc_queue_sync_done(gc); + if (gc) + nft_trans_gc_queue_sync_done(gc); } static u64 nft_rbtree_privsize(const struct nlattr * const nla[], -- 2.43.0