diff options
| author | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-01-07 23:00:15 +0100 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-01-17 12:02:46 +0100 |
| commit | 3c13725f43dcf43ad8a9bcd6a9f12add19a8f93e (patch) | |
| tree | eeb477cc750b6ff0f3e1e0df4df3651714f0f025 /net | |
| parent | netfilter: nf_tables: validate .maxattr at expression registration (diff) | |
| download | linux-3c13725f43dcf43ad8a9bcd6a9f12add19a8f93e.tar.xz linux-3c13725f43dcf43ad8a9bcd6a9f12add19a8f93e.zip | |
netfilter: nf_tables: bail out if stateful expression provides no .clone
All existing NFT_EXPR_STATEFUL provide a .clone interface, remove
fallback to copy content of stateful expression since this is never
exercised and bail out if .clone interface is not defined.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/netfilter/nf_tables_api.c | 15 |
1 files changed, 7 insertions, 8 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 2548d7d56408..b3db97440db1 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3274,14 +3274,13 @@ int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src) { int err; - if (src->ops->clone) { - dst->ops = src->ops; - err = src->ops->clone(dst, src); - if (err < 0) - return err; - } else { - memcpy(dst, src, src->ops->size); - } + if (WARN_ON_ONCE(!src->ops->clone)) + return -EINVAL; + + dst->ops = src->ops; + err = src->ops->clone(dst, src); + if (err < 0) + return err; __module_get(src->ops->type->owner); |