Merge "netfilter: x_tables: fix unconditional helper" (4081ac68) · Commits · e / devices / android_kernel_xiaomi_markw

net/ipv4/netfilter/arp_tables.c

+9 −9

Original line number	Diff line number	Diff line
		@@ -355,11 +355,12 @@ unsigned int arpt_do_table(struct sk_buff *skb,
		}

		/* All zeroes == unconditional rule. */
		static inline bool unconditional(const struct arpt_arp *arp)
		static inline bool unconditional(const struct arpt_entry *e)
		{
		static const struct arpt_arp uncond;

		return memcmp(arp, &uncond, sizeof(uncond)) == 0;
		return e->target_offset == sizeof(struct arpt_entry) &&
		memcmp(&e->arp, &uncond, sizeof(uncond)) == 0;
		}

		/* Figures out from what hook each rule can be called: returns 0 if
		@@ -398,11 +399,10 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
		\|= ((1 << hook) \| (1 << NF_ARP_NUMHOOKS));

		/* Unconditional return/END. */
		if ((e->target_offset == sizeof(struct arpt_entry) &&
		if ((unconditional(e) &&
		(strcmp(t->target.u.user.name,
		XT_STANDARD_TARGET) == 0) &&
		t->verdict < 0 && unconditional(&e->arp)) \|\|
		visited) {
		t->verdict < 0) \|\| visited) {
		unsigned int oldpos, size;

		if ((strcmp(t->target.u.user.name,
		@@ -547,7 +547,7 @@ static bool check_underflow(const struct arpt_entry *e)
		const struct xt_entry_target *t;
		unsigned int verdict;

		if (!unconditional(&e->arp))
		if (!unconditional(e))
		return false;
		t = arpt_get_target_c(e);
		if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
		@@ -588,7 +588,7 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
		newinfo->hook_entry[h] = hook_entries[h];
		if ((unsigned char *)e - base == underflows[h]) {
		if (!check_underflow(e)) {
		pr_err("Underflows must be unconditional and "
		pr_debug("Underflows must be unconditional and "
		"use the STANDARD target with "
		"ACCEPT/DROP\n");
		return -EINVAL;

net/ipv4/netfilter/ip_tables.c

+11 −12

Original line number	Diff line number	Diff line
		@@ -168,11 +168,12 @@ get_entry(const void *base, unsigned int offset)

		/* All zeroes == unconditional rule. */
		/* Mildly perf critical (only if packet tracing is on) */
		static inline bool unconditional(const struct ipt_ip *ip)
		static inline bool unconditional(const struct ipt_entry *e)
		{
		static const struct ipt_ip uncond;

		return memcmp(ip, &uncond, sizeof(uncond)) == 0;
		return e->target_offset == sizeof(struct ipt_entry) &&
		memcmp(&e->ip, &uncond, sizeof(uncond)) == 0;
		#undef FWINV
		}

		@@ -229,11 +230,10 @@ get_chainname_rulenum(const struct ipt_entry s, const struct ipt_entry e,
		} else if (s == e) {
		(*rulenum)++;

		if (s->target_offset == sizeof(struct ipt_entry) &&
		if (unconditional(s) &&
		strcmp(t->target.u.kernel.target->name,
		XT_STANDARD_TARGET) == 0 &&
		t->verdict < 0 &&
		unconditional(&s->ip)) {
		t->verdict < 0) {
		/* Tail of chains: STANDARD target (return/policy) */
		comment = chainname == hookname
		? comments[NF_IP_TRACE_COMMENT_POLICY]
		@@ -472,11 +472,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
		e->comefrom \|= ((1 << hook) \| (1 << NF_INET_NUMHOOKS));

		/* Unconditional return/END. */
		if ((e->target_offset == sizeof(struct ipt_entry) &&
		if ((unconditional(e) &&
		(strcmp(t->target.u.user.name,
		XT_STANDARD_TARGET) == 0) &&
		t->verdict < 0 && unconditional(&e->ip)) \|\|
		visited) {
		t->verdict < 0) \|\| visited) {
		unsigned int oldpos, size;

		if ((strcmp(t->target.u.user.name,
		@@ -709,7 +708,7 @@ static bool check_underflow(const struct ipt_entry *e)
		const struct xt_entry_target *t;
		unsigned int verdict;

		if (!unconditional(&e->ip))
		if (!unconditional(e))
		return false;
		t = ipt_get_target_c(e);
		if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
		@@ -751,7 +750,7 @@ check_entry_size_and_hooks(struct ipt_entry *e,
		newinfo->hook_entry[h] = hook_entries[h];
		if ((unsigned char *)e - base == underflows[h]) {
		if (!check_underflow(e)) {
		pr_err("Underflows must be unconditional and "
		pr_debug("Underflows must be unconditional and "
		"use the STANDARD target with "
		"ACCEPT/DROP\n");
		return -EINVAL;

net/ipv6/netfilter/ip6_tables.c

+11 −12

Original line number	Diff line number	Diff line
		@@ -195,11 +195,12 @@ get_entry(const void *base, unsigned int offset)

		/* All zeroes == unconditional rule. */
		/* Mildly perf critical (only if packet tracing is on) */
		static inline bool unconditional(const struct ip6t_ip6 *ipv6)
		static inline bool unconditional(const struct ip6t_entry *e)
		{
		static const struct ip6t_ip6 uncond;

		return memcmp(ipv6, &uncond, sizeof(uncond)) == 0;
		return e->target_offset == sizeof(struct ip6t_entry) &&
		memcmp(&e->ipv6, &uncond, sizeof(uncond)) == 0;
		}

		static inline const struct xt_entry_target *
		@@ -255,11 +256,10 @@ get_chainname_rulenum(const struct ip6t_entry s, const struct ip6t_entry e,
		} else if (s == e) {
		(*rulenum)++;

		if (s->target_offset == sizeof(struct ip6t_entry) &&
		if (unconditional(s) &&
		strcmp(t->target.u.kernel.target->name,
		XT_STANDARD_TARGET) == 0 &&
		t->verdict < 0 &&
		unconditional(&s->ipv6)) {
		t->verdict < 0) {
		/* Tail of chains: STANDARD target (return/policy) */
		comment = chainname == hookname
		? comments[NF_IP6_TRACE_COMMENT_POLICY]
		@@ -482,11 +482,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
		e->comefrom \|= ((1 << hook) \| (1 << NF_INET_NUMHOOKS));

		/* Unconditional return/END. */
		if ((e->target_offset == sizeof(struct ip6t_entry) &&
		if ((unconditional(e) &&
		(strcmp(t->target.u.user.name,
		XT_STANDARD_TARGET) == 0) &&
		t->verdict < 0 &&
		unconditional(&e->ipv6)) \|\| visited) {
		t->verdict < 0) \|\| visited) {
		unsigned int oldpos, size;

		if ((strcmp(t->target.u.user.name,
		@@ -720,7 +719,7 @@ static bool check_underflow(const struct ip6t_entry *e)
		const struct xt_entry_target *t;
		unsigned int verdict;

		if (!unconditional(&e->ipv6))
		if (!unconditional(e))
		return false;
		t = ip6t_get_target_c(e);
		if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
		@@ -762,7 +761,7 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
		newinfo->hook_entry[h] = hook_entries[h];
		if ((unsigned char *)e - base == underflows[h]) {
		if (!check_underflow(e)) {
		pr_err("Underflows must be unconditional and "
		pr_debug("Underflows must be unconditional and "
		"use the STANDARD target with "
		"ACCEPT/DROP\n");
		return -EINVAL;