We have to stop iterating on the rule expressions if the cgroup mismatches. Moreover, make sure a non-full socket from the input path leads us to a crash. Fixes: ce67417 ("netfilter: nft_meta: add cgroup support") Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> --- net/netfilter/nft_meta.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index 5197874..d79ce88 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -166,9 +166,8 @@ void nft_meta_get_eval(const struct nft_expr *expr, dest->data[0] = out->group; break; case NFT_META_CGROUP: - if (skb->sk == NULL) - break; - + if (skb->sk == NULL || !sk_fullsock(skb->sk)) + goto err; dest->data[0] = skb->sk->sk_classid; break; default: -- 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html