Commit 169384fb authored by Florian Westphal's avatar Florian Westphal
Browse files

netfilter: nf_tables: allow loop termination for pending fatal signal 



abort early so task can exit faster if a fatal signal is pending,
no need to continue validation in that case.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
parent aa222dd1

net/netfilter/nf_tables_api.c

+6 −0
Original line number Diff line number Diff line
@@ -3675,6 +3675,9 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) 
		return -EMLINK;



	list_for_each_entry(rule, &chain->rules, list) {

		if (fatal_signal_pending(current))

			return -EINTR;



		if (!nft_is_active_next(ctx->net, rule))

			continue;
@@ -10479,6 +10482,9 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx, 
	if (ctx->chain == chain)

		return -ELOOP;



	if (fatal_signal_pending(current))

		return -EINTR;



	list_for_each_entry(rule, &chain->rules, list) {

		nft_rule_for_each_expr(expr, last, rule) {

			struct nft_immediate_expr *priv;