Commit 724f32699aea for kernel

commit 724f32699aeabcbd294377904b40b456fd5c67eb
Author: Jozsef Kadlecsik <kadlec@netfilter.org>
Date:   Thu Jul 2 15:47:00 2026 +0200

    netfilter: ipset: allocate the proper memory for the generic hash structure

    Because a single create function is emitted for every hash type,
    from the IPv4 and IPv6 generic hash structure definitions the last
    one, i.e. the IPv6 was in effect for IPv4 too. Use the proper size
    when allocating the structure. Comment properly that because create()
    refers to elements of the generic hash structure, all referred ones
    must come before the IPv4/IPv6 dependent 'next' member.

    Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
    Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
index c0132d0f4cc0..8231317b0f1f 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
+++ b/net/netfilter/ipset/ip_set_hash_gen.h
@@ -303,10 +303,13 @@ struct htype {
 	u8 netmask;		/* netmask value for subnets to store */
 	union nf_inet_addr bitmask;	/* stores bitmask */
 #endif
-	struct mtype_elem next; /* temporary storage for uadd */
 #ifdef IP_SET_HASH_WITH_NETS
 	struct net_prefixes nets[NLEN]; /* book-keeping of prefixes */
 #endif
+	/* Because 'next' is IPv4/IPv6 dependent, no elements of this
+	 * structure and referred in create() may come after 'next'.
+	 */
+	struct mtype_elem next; /* temporary storage for uadd */
 };

 /* ADD|DEL entries saved during resize */
@@ -1584,7 +1587,13 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set,
 	if (tb[IPSET_ATTR_MAXELEM])
 		maxelem = ip_set_get_h32(tb[IPSET_ATTR_MAXELEM]);

-	hsize = sizeof(*h);
+#ifdef IP_SET_PROTO_UNDEF
+	hsize = sizeof(struct htype);
+#else
+	hsize = set->family == NFPROTO_IPV6 ?
+		sizeof(struct IPSET_TOKEN(HTYPE, 6)) :
+		sizeof(struct IPSET_TOKEN(HTYPE, 4));
+#endif
 	h = kzalloc(hsize, GFP_KERNEL);
 	if (!h)
 		return -ENOMEM;