diff options
| author | Paolo Abeni <pabeni@redhat.com> | 2023-05-04 11:48:10 +0300 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2023-05-04 11:48:11 +0300 |
| commit | b9850ec0027ca7639141706101bce09b8e3224e6 (patch) | |
| tree | 430d496c035af6d595a619ddca3b0f59fd002dc9 | |
| parent | 6a341729fb31b4c5df9f74f24b4b1c98410c9b87 (diff) | |
| parent | f057b63bc11d86a98176de31b437e46789f44d8f (diff) | |
| download | linux-b9850ec0027ca7639141706101bce09b8e3224e6.tar.xz | |
Merge tag 'nf-23-05-03' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Pablo Neira Ayuso says:
====================
Netfilter fixes for net
The following patchset contains one Netfilter fix:
1) Restore 'ct state untracked' matching with CONFIG_RETPOLINE=y,
from Florian Westphal.
* tag 'nf-23-05-03' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
netfilter: nf_tables: fix ct untracked match breakage
====================
Link: https://lore.kernel.org/r/20230503201143.12310-1-pablo@netfilter.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
| -rw-r--r-- | net/netfilter/nft_ct_fast.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/net/netfilter/nft_ct_fast.c b/net/netfilter/nft_ct_fast.c index 89983b0613fa..e684c8a91848 100644 --- a/net/netfilter/nft_ct_fast.c +++ b/net/netfilter/nft_ct_fast.c @@ -15,10 +15,6 @@ void nft_ct_get_fast_eval(const struct nft_expr *expr, unsigned int state; ct = nf_ct_get(pkt->skb, &ctinfo); - if (!ct) { - regs->verdict.code = NFT_BREAK; - return; - } switch (priv->key) { case NFT_CT_STATE: @@ -30,6 +26,16 @@ void nft_ct_get_fast_eval(const struct nft_expr *expr, state = NF_CT_STATE_INVALID_BIT; *dest = state; return; + default: + break; + } + + if (!ct) { + regs->verdict.code = NFT_BREAK; + return; + } + + switch (priv->key) { case NFT_CT_DIRECTION: nft_reg_store8(dest, CTINFO2DIR(ctinfo)); return; |