Commit 4d26ab00 authored by Florian Westphal's avatar Florian Westphal
Browse files

netfilter: nf_tables: mask out non-verdict bits when checking return value 



nftables trace infra must mask out the non-verdict bit parts of the
return value, else followup changes that 'return errno << 8 | NF_STOLEN'
will cause breakage.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
parent e15e5027

net/netfilter/nf_tables_core.c

+1 −1
Original line number Diff line number Diff line
@@ -115,7 +115,7 @@ static noinline void __nft_trace_verdict(const struct nft_pktinfo *pkt, 
{

	enum nft_trace_types type;



	switch (regs->verdict.code) {

	switch (regs->verdict.code & NF_VERDICT_MASK) {

	case NFT_CONTINUE:

	case NFT_RETURN:

		type = NFT_TRACETYPE_RETURN;

net/netfilter/nf_tables_trace.c

+6 −2
Original line number Diff line number Diff line
@@ -258,17 +258,21 @@ void nft_trace_notify(const struct nft_pktinfo *pkt, 
	case __NFT_TRACETYPE_MAX:

		break;

	case NFT_TRACETYPE_RETURN:

	case NFT_TRACETYPE_RULE:

	case NFT_TRACETYPE_RULE: {

		unsigned int v;



		if (nft_verdict_dump(skb, NFTA_TRACE_VERDICT, verdict))

			goto nla_put_failure;



		/* pkt->skb undefined iff NF_STOLEN, disable dump */

		if (verdict->code == NF_STOLEN)

		v = verdict->code & NF_VERDICT_MASK;

		if (v == NF_STOLEN)

			info->packet_dumped = true;

		else

			mark = pkt->skb->mark;



		break;

	}

	case NFT_TRACETYPE_POLICY:

		mark = pkt->skb->mark;