aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJagdish Motwani <jagdish.motwani@sophos.com>2019-05-13 23:47:40 +0530
committerPaul Gortmaker <paul.gortmaker@windriver.com>2019-09-16 12:21:32 -0400
commit35c2f40aa52217a58d780b60703f23b563f57fec (patch)
tree213279b8fa9ddcaf038afb1e1f2e43bf1dabe67f
parent9e48d8163f4dd93d88ba158c0fd57bd3eaeada47 (diff)
downloadlinux-yocto-35c2f40aa52217a58d780b60703f23b563f57fec.tar.gz
linux-yocto-35c2f40aa52217a58d780b60703f23b563f57fec.tar.bz2
linux-yocto-35c2f40aa52217a58d780b60703f23b563f57fec.zip
netfilter: nf_queue: fix reinject verdict handling
commit 946c0d8e6ed43dae6527e878d0077c1e11015db0 upstream. This patch fixes netfilter hook traversal when there are more than 1 hooks returning NF_QUEUE verdict. When the first queue reinjects the packet, 'nf_reinject' starts traversing hooks with a proper hook_index. However, if it again receives a NF_QUEUE verdict (by some other netfilter hook), it queues the packet with a wrong hook_index. So, when the second queue reinjects the packet, it re-executes hooks in between. Fixes: 960632ece694 ("netfilter: convert hook list to an array") Signed-off-by: Jagdish Motwani <jagdish.motwani@sophos.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
-rw-r--r--net/netfilter/nf_queue.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index d67a96a25a68..7569ba00e732 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -238,6 +238,7 @@ static unsigned int nf_iterate(struct sk_buff *skb,
repeat:
verdict = nf_hook_entry_hookfn(hook, skb, state);
if (verdict != NF_ACCEPT) {
+ *index = i;
if (verdict != NF_REPEAT)
return verdict;
goto repeat;