diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2024-01-04 03:05:23 +0100 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2024-01-04 03:05:23 +0100 |
| commit | cbc74fc025f905fca5154254b9d9acc0b09a8cf4 (patch) | |
| tree | 77f41c46780bcae28e7b82934779e6588a6fbaee /net | |
| parent | Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/ne... (diff) | |
| parent | netfilter: nft_immediate: drop chain reference counter on error (diff) | |
| download | linux-cbc74fc025f905fca5154254b9d9acc0b09a8cf4.tar.xz linux-cbc74fc025f905fca5154254b9d9acc0b09a8cf4.zip | |
Merge tag 'nf-24-01-03' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Pablo Neira Ayuso says:
====================
Netfilter fixes for net
The following patchset contains Netfilter fixes for net:
1) Fix nat packets in the related state in OVS, from Brad Cowie.
2) Drop chain reference counter on error path in case chain binding
fails.
* tag 'nf-24-01-03' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
netfilter: nft_immediate: drop chain reference counter on error
netfilter: nf_nat: fix action not being set for all ct states
====================
Link: https://lore.kernel.org/r/20240103113001.137936-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nf_nat_ovs.c | 3 | ||||
| -rw-r--r-- | net/netfilter/nft_immediate.c | 2 |
2 files changed, 3 insertions, 2 deletions
diff --git a/net/netfilter/nf_nat_ovs.c b/net/netfilter/nf_nat_ovs.c index 551abd2da614..0f9a559f6207 100644 --- a/net/netfilter/nf_nat_ovs.c +++ b/net/netfilter/nf_nat_ovs.c @@ -75,9 +75,10 @@ static int nf_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct, } err = nf_nat_packet(ct, ctinfo, hooknum, skb); +out: if (err == NF_ACCEPT) *action |= BIT(maniptype); -out: + return err; } diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c index fccb3cf7749c..6475c7abc1fe 100644 --- a/net/netfilter/nft_immediate.c +++ b/net/netfilter/nft_immediate.c @@ -78,7 +78,7 @@ static int nft_immediate_init(const struct nft_ctx *ctx, case NFT_GOTO: err = nf_tables_bind_chain(ctx, chain); if (err < 0) - return err; + goto err1; break; default: break; |