From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Fri, 27 Mar 2015 11:14:13 +0000 (+0100)
Subject: netfilter: nft_meta: fix cgroup matching
X-Git-Tag: v4.1-rc1~128^2~38^2~14
X-Git-Url: http://git.cascardo.eti.br/?a=commitdiff_plain;h=c5035c77f89364d2da2871d829553bd1a4321940;p=cascardo%2Flinux.git

netfilter: nft_meta: fix cgroup matching

We have to stop iterating on the rule expressions if the cgroup
mismatches. Moreover, make sure a non-full socket from the input path
leads us to a crash.

Fixes: ce67417 ("netfilter: nft_meta: add cgroup support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 5197874372ec..d79ce88be77f 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -166,9 +166,8 @@ void nft_meta_get_eval(const struct nft_expr *expr,
 		dest->data[0] = out->group;
 		break;
 	case NFT_META_CGROUP:
-		if (skb->sk == NULL)
-			break;
-
+		if (skb->sk == NULL || !sk_fullsock(skb->sk))
+			goto err;
 		dest->data[0] = skb->sk->sk_classid;
 		break;
 	default: