diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2015-03-27 12:14:13 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2015-04-01 11:33:00 +0200 |
| commit | c5035c77f89364d2da2871d829553bd1a4321940 (patch) | |
| tree | d403a5f3f17acf2b1e0dc7946937dc008026072d /net/netfilter | |
| parent | afb7718016fcb0370ac29a83b2839c78b76c2960 (diff) | |
netfilter: nft_meta: fix cgroup matching
We have to stop iterating on the rule expressions if the cgroup
mismatches. Moreover, make sure a non-full socket from the input path
leads us to a crash.
Fixes: ce67417 ("netfilter: nft_meta: add cgroup support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter')
| -rw-r--r-- | net/netfilter/nft_meta.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index 5197874372ec..d79ce88be77f 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -166,9 +166,8 @@ void nft_meta_get_eval(const struct nft_expr *expr, dest->data[0] = out->group; break; case NFT_META_CGROUP: - if (skb->sk == NULL) - break; - + if (skb->sk == NULL || !sk_fullsock(skb->sk)) + goto err; dest->data[0] = skb->sk->sk_classid; break; default: |