diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2022-03-14 18:23:08 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2022-03-20 00:29:47 +0100 |
| commit | 71ef842d73f63b10ce84629dada75f402c6df36e (patch) | |
| tree | 5fbe458c956f96fc8e1fd61ef0c749afea44cbbf /net/netfilter/nft_immediate.c | |
| parent | 5da03b56662618ac469461df0f33a1cf1dd18813 (diff) | |
| download | linux-71ef842d73f63b10ce84629dada75f402c6df36e.tar.gz | |
netfilter: nft_immediate: cancel register tracking for data destination register
The immediate expression might clobber existing data on the registers,
cancel register tracking for the destination register.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nft_immediate.c')
| -rw-r--r-- | net/netfilter/nft_immediate.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c index d0f67d325bdfd..b80f7b5073495 100644 --- a/net/netfilter/nft_immediate.c +++ b/net/netfilter/nft_immediate.c @@ -223,6 +223,17 @@ static bool nft_immediate_offload_action(const struct nft_expr *expr) return false; } +static bool nft_immediate_reduce(struct nft_regs_track *track, + const struct nft_expr *expr) +{ + const struct nft_immediate_expr *priv = nft_expr_priv(expr); + + if (priv->dreg != NFT_REG_VERDICT) + nft_reg_track_cancel(track, priv->dreg, priv->dlen); + + return false; +} + static const struct nft_expr_ops nft_imm_ops = { .type = &nft_imm_type, .size = NFT_EXPR_SIZE(sizeof(struct nft_immediate_expr)), @@ -233,6 +244,7 @@ static const struct nft_expr_ops nft_imm_ops = { .destroy = nft_immediate_destroy, .dump = nft_immediate_dump, .validate = nft_immediate_validate, + .reduce = nft_immediate_reduce, .offload = nft_immediate_offload, .offload_action = nft_immediate_offload_action, }; |