]> git.baikalelectronics.ru Git - kernel.git/commit
netfilter: nf_tables: disable expression reduction infra
authorPablo Neira Ayuso <pablo@netfilter.org>
Wed, 18 May 2022 12:51:34 +0000 (14:51 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 18 May 2022 15:34:26 +0000 (17:34 +0200)
commitf9e91b748805372852140e710de5e4f0438315de
tree57ae651fc2ccca2c60d780ba18289b954104dc01
parent77e067154416b38c968e53a97229304c914d3d16
netfilter: nf_tables: disable expression reduction infra

Either userspace or kernelspace need to pre-fetch keys inconditionally
before comparisons for this to work. Otherwise, register tracking data
is misleading and it might result in reducing expressions which are not
yet registers.

First expression is also guaranteed to be evaluated always, however,
certain expressions break before writing data to registers, before
comparing the data, leaving the register in undetermined state.

This patch disables this infrastructure by now.

Fixes: cdba27802fee ("netfilter: nf_tables: do not reduce read-only expressions")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_tables_api.c