mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 22:02:02 +00:00
netfilter: nft_meta: fix cgroup matching
We have to stop iterating on the rule expressions if the cgroup
mismatches. Moreover, make sure a non-full socket from the input path
leads us to a crash.
Fixes: ce67417
("netfilter: nft_meta: add cgroup support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
afb7718016
commit
c5035c77f8
1 changed files with 2 additions and 3 deletions
|
@ -166,9 +166,8 @@ void nft_meta_get_eval(const struct nft_expr *expr,
|
|||
dest->data[0] = out->group;
|
||||
break;
|
||||
case NFT_META_CGROUP:
|
||||
if (skb->sk == NULL)
|
||||
break;
|
||||
|
||||
if (skb->sk == NULL || !sk_fullsock(skb->sk))
|
||||
goto err;
|
||||
dest->data[0] = skb->sk->sk_classid;
|
||||
break;
|
||||
default:
|
||||
|
|
Loading…
Reference in a new issue