[PATCH] netfilter: No increment ctx->level for NFT_GOTO

[Steve Hill <steve@xxxxxxxxxxxx>]

nft_immediate_validate() and nft_lookup_validate_setelem() treat 
NFT_GOTO and NFT_JUMP identically, incrementing pctx->level for both. 
This results in a -EMLINK ("Too many links") being unexpectedly returned 
for rulesets that use lots of gotos.

This fixes this problem by not incrementing pctx->level when following 
gotos.

Fixes: https://bugzilla.netfilter.org/show_bug.cgi?id=1459
Signed-off-by: Steve Hill <steve@xxxxxxxxxxxx>
---
diff -urN 
linux-4.18.0-193.14.2.el8.x86_64.vanilla/net/netfilter/nft_immediate.c 
linux-4.18.0-193.14.2.el8.x86_64.opendium/net/netfilter/nft_immediate.c
--- 
linux-4.18.0-193.14.2.el8.x86_64.vanilla/net/netfilter/nft_immediate.c 
2020-07-19 15:03:44.000000000 +0100
+++ 
linux-4.18.0-193.14.2.el8.x86_64.opendium/net/netfilter/nft_immediate.c 
2020-08-26 15:39:47.004754668 +0100
@@ -113,13 +113,19 @@

     switch (data->verdict.code) {
     case NFT_JUMP:
-    case NFT_GOTO:
         pctx->level++;
         err = nft_chain_validate(ctx, data->verdict.chain);
         if (err < 0)
             return err;
         pctx->level--;
         break;
+    case NFT_GOTO:
+        err = nft_chain_validate(ctx, data->verdict.chain);
+        if (err < 0)
+            return err;
+        break;
     default:
         break;
     }
diff -urN 
linux-4.18.0-193.14.2.el8.x86_64.vanilla/net/netfilter/nft_lookup.c 
linux-4.18.0-193.14.2.el8.x86_64.opendium/net/netfilter/nft_lookup.c
--- linux-4.18.0-193.14.2.el8.x86_64.vanilla/net/netfilter/nft_lookup.c 
2020-07-19 15:03:44.000000000 +0100
+++ linux-4.18.0-193.14.2.el8.x86_64.opendium/net/netfilter/nft_lookup.c 
2020-08-26 15:42:35.885223417 +0100
@@ -176,13 +176,19 @@
     data = nft_set_ext_data(ext);
     switch (data->verdict.code) {
     case NFT_JUMP:
-    case NFT_GOTO:
         pctx->level++;
         err = nft_chain_validate(ctx, data->verdict.chain);
         if (err < 0)
             return err;
         pctx->level--;
         break;
+    case NFT_GOTO:
+        err = nft_chain_validate(ctx, data->verdict.chain);
+        if (err < 0)
+            return err;
+        break;
     default:
         break;
     }

begin:vcard
fn:Steve Hill
n:Hill;Steve
org:Opendium Limited
adr:1 Brue Close;;Highfield House;Bruton;Somerset;BA10 0HY;England
email;internet:steve@xxxxxxxxxxxx
title:Technical Director
x-mozilla-html:FALSE
url:https://www.opendium.com
version:2.1
end:vcard