leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

netfilter: nft_meta: fix cgroup matching

Browse Source 
We have to stop iterating on the rule expressions if the cgroup
mismatches. Moreover, make sure a non-full socket from the input path
leads us to a crash.

Fixes: ce67417 ("netfilter: nft_meta: add cgroup support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
Pablo Neira Ayuso 2015-03-27 12:14:13 +01:00
parent afb7718016
commit c5035c77f8
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
net/netfilter/nft_meta.c
View File

@ -166,9 +166,8 @@ void nft_meta_get_eval(const struct nft_expr *expr,
dest->data[0] = out->group;
break;
case NFT_META_CGROUP:
if (skb->sk == NULL)
break;
if (skb->sk == NULL || !sk_fullsock(skb->sk))
goto err;
dest->data[0] = skb->sk->sk_classid;
break;
default: