We cannot assume i->key->key is EXPR_VALUE, we could look e.g. at a range,
which will trigger an assertion failure in binop_adjust_one().
We should call __binop_adjust recursively again in the EXPR_SET_ELEM case,
using key as new input.
Fixes: b8b8e7b6ae10 ("evaluate: transfer right shifts to set reference side")
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
---
src/netlink_delinearize.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 2637f4baaec4..655de9e252b8 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -1515,7 +1515,7 @@ static void __binop_adjust(const struct expr *binop, struct expr *right,
binop_adjust_one(binop, i->key->right, shift);
break;
case EXPR_SET_ELEM:
- binop_adjust_one(binop, i->key->key, shift);
+ __binop_adjust(binop, i->key->key, shift);
break;
default:
BUG("unknown expression type %s\n", i->key->ops->name);
--
2.13.6
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
