diff options
| author | wenxu <wenxu@ucloud.cn> | 2021-07-02 11:34:31 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-07-25 14:35:14 +0200 |
| commit | 813d45499f51d7c7992b035780dcd80315e66f51 (patch) | |
| tree | cef495a59f5aa94636ffb19e873fbb192beb1e4d /net/sched | |
| parent | 24973073562f1552a266170f609a9451d12ca368 (diff) | |
net/sched: act_ct: fix err check for nf_conntrack_confirm
commit 8955b90c3cdad199137809aac8ccbbb585355913 upstream.
The confirm operation should be checked. If there are any failed,
the packet should be dropped like in ovs and netfilter.
Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct")
Signed-off-by: wenxu <wenxu@ucloud.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/sched')
| -rw-r--r-- | net/sched/act_ct.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c index 16c4cbf6d1f0..02d4491991b5 100644 --- a/net/sched/act_ct.c +++ b/net/sched/act_ct.c @@ -474,7 +474,8 @@ static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a, /* This will take care of sending queued events * even if the connection is already confirmed. */ - nf_conntrack_confirm(skb); + if (nf_conntrack_confirm(skb) != NF_ACCEPT) + goto drop; } out_push: |