Commit e50ae445 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_lookup: only cancel tracking for clobbered dregs 



In most cases, nft_lookup will be read-only, i.e. won't clobber
registers.  In case of map, we need to cancel the registers that will
see stores.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 03858af0

net/netfilter/nft_lookup.c

+12 −0
Original line number Diff line number Diff line
@@ -253,6 +253,17 @@ static int nft_lookup_validate(const struct nft_ctx *ctx, 
	return 0;

}



static bool nft_lookup_reduce(struct nft_regs_track *track,

			      const struct nft_expr *expr)

{

	const struct nft_lookup *priv = nft_expr_priv(expr);



	if (priv->set->flags & NFT_SET_MAP)

		nft_reg_track_cancel(track, priv->dreg, priv->set->dlen);



	return false;

}



static const struct nft_expr_ops nft_lookup_ops = {

	.type		= &nft_lookup_type,

	.size		= NFT_EXPR_SIZE(sizeof(struct nft_lookup)),
@@ -263,6 +274,7 @@ static const struct nft_expr_ops nft_lookup_ops = { 
	.destroy	= nft_lookup_destroy,

	.dump		= nft_lookup_dump,

	.validate	= nft_lookup_validate,

	.reduce		= nft_lookup_reduce,

};



struct nft_expr_type nft_lookup_type __read_mostly = {