netfilter: nf_tables: disable expression reduction infra
authorPablo Neira Ayuso <pablo@netfilter.org>
Wed, 18 May 2022 12:51:34 +0000 (14:51 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 18 May 2022 15:34:26 +0000 (17:34 +0200)
commit9e539c5b6d9c5b996e45105921ee9dd955c0f535
tree57ae651fc2ccca2c60d780ba18289b954104dc01
parent2738d9d963bd1f06d5114c2b4fa5771a95703991
netfilter: nf_tables: disable expression reduction infra

Either userspace or kernelspace need to pre-fetch keys inconditionally
before comparisons for this to work. Otherwise, register tracking data
is misleading and it might result in reducing expressions which are not
yet registers.

First expression is also guaranteed to be evaluated always, however,
certain expressions break before writing data to registers, before
comparing the data, leaving the register in undetermined state.

This patch disables this infrastructure by now.

Fixes: b2d306542ff9 ("netfilter: nf_tables: do not reduce read-only expressions")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_tables_api.c