Commit 039b1f4f authored by Fernando Fernandez Mancera's avatar Fernando Fernandez Mancera Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_socket: fix erroneous socket assignment

The socket assignment is wrong, see skb_orphan():
When skb->destructor callback is not set, but skb->sk is set, this hits BUG().

Fixes: 554ced0a

 ("netfilter: nf_tables: add support for native socket matching")
Signed-off-by: default avatarFernando Fernandez Mancera <>
Signed-off-by: default avatarPablo Neira Ayuso <>
parent 48bd0d68
......@@ -47,9 +47,6 @@ static void nft_socket_eval(const struct nft_expr *expr,
/* So that subsequent socket matching not to require other lookups. */
skb->sk = sk;
switch(priv->key) {
nft_reg_store8(dest, inet_sk_transparent(sk));
......@@ -66,6 +63,9 @@ static void nft_socket_eval(const struct nft_expr *expr,
regs->verdict.code = NFT_BREAK;
if (sk != skb->sk)
static const struct nla_policy nft_socket_policy[NFTA_SOCKET_MAX + 1] = {
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment