netfilter: nf_tables: mask out non-verdict bits when checking return value

nftables trace infra must mask out the non-verdict bit parts of the
return value, else followup changes that 'return errno << 8 | NF_STOLEN'
will cause breakage.

Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 4d0ce12221f66d6ffdf444fdb44383e573e47d74..6009b423f60aae61e75ca91dcdaf73bc9bee26a8 100644 (file)
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -115,7 +115,7 @@ static noinline void __nft_trace_verdict(const struct nft_pktinfo *pkt,
 {
        enum nft_trace_types type;
 
-       switch (regs->verdict.code) {
+       switch (regs->verdict.code & NF_VERDICT_MASK) {
        case NFT_CONTINUE:
        case NFT_RETURN:
                type = NFT_TRACETYPE_RETURN;

diff --git a/net/netfilter/nf_tables_trace.c b/net/netfilter/nf_tables_trace.c
index 6d41c0bd3d78716ef708267cb945744cb800faca..a83637e3f4554d433b597226db9a85d2e109d285 100644 (file)
--- a/net/netfilter/nf_tables_trace.c
+++ b/net/netfilter/nf_tables_trace.c
@@ -258,17 +258,21 @@ void nft_trace_notify(const struct nft_pktinfo *pkt,
        case __NFT_TRACETYPE_MAX:
                break;
        case NFT_TRACETYPE_RETURN:
-       case NFT_TRACETYPE_RULE:
+       case NFT_TRACETYPE_RULE: {
+               unsigned int v;
+
                if (nft_verdict_dump(skb, NFTA_TRACE_VERDICT, verdict))
                        goto nla_put_failure;
 
                /* pkt->skb undefined iff NF_STOLEN, disable dump */
-               if (verdict->code == NF_STOLEN)
+               v = verdict->code & NF_VERDICT_MASK;
+               if (v == NF_STOLEN)
                        info->packet_dumped = true;
                else
                        mark = pkt->skb->mark;
 
                break;
+       }
        case NFT_TRACETYPE_POLICY:
                mark = pkt->skb->mark;