• E
    netfilter: NF_HOOK_COND has wrong conditional · ac5aa2e3
    Eric Paris 提交于
    The NF_HOOK_COND returns 0 when it shouldn't due to what I believe to be an
    error in the code as the order of operations is not what was intended.  C will
    evalutate == before =.  Which means ret is getting set to the bool result,
    rather than the return value of the function call.  The code says
    
    if (ret = function() == 1)
    when it meant to say:
    if ((ret = function()) == 1)
    
    Normally the compiler would warn, but it doesn't notice it because its
    a actually complex conditional and so the wrong code is wrapped in an explict
    set of () [exactly what the compiler wants you to do if this was intentional].
    Fixing this means that errors when netfilter denies a packet get propagated
    back up the stack rather than lost.
    
    Problem introduced by commit 2249065f (netfilter: get rid of the grossness
    in netfilter.h).
    Signed-off-by: NEric Paris <eparis@redhat.com>
    Cc: stable@kernel.org
    Signed-off-by: NPatrick McHardy <kaber@trash.net>
    ac5aa2e3
netfilter.h 10.0 KB