Commit 8955b90c authored Jul 02, 2021 by wenxu Committed by David S. Miller Jul 02, 2021

net/sched: act_ct: fix err check for nf_conntrack_confirm



The confirm operation should be checked. If there are any failed,
the packet should be dropped like in ovs and netfilter.

Fixes: b57dc7c1 ("net/sched: Introduce action ct")
Signed-off-by: wenxu <wenxu@ucloud.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 1bfa4d0c

net/sched/act_ct.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -1026,7 +1026,8 @@ static int tcf_ct_act(struct sk_buff skb, const struct tc_action a,
		/* This will take care of sending queued events
		* even if the connection is already confirmed.
		*/
		nf_conntrack_confirm(skb);
		if (nf_conntrack_confirm(skb) != NF_ACCEPT)
		goto drop;
		}

		if (!skip_add)