This assert can trigger as follows:
set s {
type integer,8
elemets = { 1 }
};
vlan id @s accept
reason is that 'vlan id' will store a 16 bit value into the dreg,
so set should use 'integer,16'.
The kernel won't detect this, as the lookup expression will only
verify that it can load one byte from the given register.
This removes the assertion, in case we hit this condition we can just
return without doing any further actions.
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
---
src/netlink_delinearize.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/src/netlink_delinearize.c b/src/netlink_delinearize.c
index 154353b8161a..6a09bc2013a4 100644
--- a/src/netlink_delinearize.c
+++ b/src/netlink_delinearize.c
@@ -1800,9 +1800,20 @@ static void binop_adjust_one(const struct expr *binop, struct expr *value,
{
struct expr *left = binop->left;
- assert(value->len >= binop->right->len);
-
mpz_rshift_ui(value->value, shift);
+
+ /* This will happen when a set has a key that is
+ * smaller than the amount of bytes loaded by the
+ * payload/exthdr expression.
+ *
+ * This can't happen with normal nft frontend,
+ * but it can happen with custom clients or with
+ * nft sets defined via 'type integer,8' and then
+ * asking "vlan id @myset".
+ */
+ if (value->len < binop->right->len)
+ return;
+
switch (left->etype) {
case EXPR_PAYLOAD:
case EXPR_EXTHDR:
--
2.23.0
