OSDN Git Service
(root)
/
sagit-ice-cold
/
kernel_xiaomi_msm8998.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
afb7718
)
netfilter: nft_meta: fix cgroup matching
author
Pablo Neira Ayuso
<pablo@netfilter.org>
Fri, 27 Mar 2015 11:14:13 +0000
(12:14 +0100)
committer
Pablo Neira Ayuso
<pablo@netfilter.org>
Wed, 1 Apr 2015 09:33:00 +0000
(11:33 +0200)
We have to stop iterating on the rule expressions if the cgroup
mismatches. Moreover, make sure a non-full socket from the input path
leads us to a crash.
Fixes:
ce67417
("netfilter: nft_meta: add cgroup support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nft_meta.c
patch
|
blob
|
history
diff --git
a/net/netfilter/nft_meta.c
b/net/netfilter/nft_meta.c
index
5197874
..
d79ce88
100644
(file)
--- a/
net/netfilter/nft_meta.c
+++ b/
net/netfilter/nft_meta.c
@@
-166,9
+166,8
@@
void nft_meta_get_eval(const struct nft_expr *expr,
dest->data[0] = out->group;
break;
case NFT_META_CGROUP:
- if (skb->sk == NULL)
- break;
-
+ if (skb->sk == NULL || !sk_fullsock(skb->sk))
+ goto err;
dest->data[0] = skb->sk->sk_classid;
break;
default: