From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E928D361977; Sat, 12 Sep 2026 19:19:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789240798; cv=none; b=H9zKdy9FqrSNwzWB3aVMMssqpuvjAIQsufgSr2ZqDTVTlWl4M36Ief+yaxVA6acLZyYiWwo9r1eWQFfgZ5eHaMaijCXb6DmaducQTVx/A4QiAFZjhvHfkFuI7cylaCJmu8xw8Azs/6bUqOzV7xSwx0lLMxCHksCnFYiAeR6EOS4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789240798; c=relaxed/simple; bh=hFr9J5YvjGiuHa+W2FpKbfzMA3xfpe8me6UCD15p0WE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=m/REUHJbezXlLawHl4j2usEOYNz7ln7qotp9EXb8J8uIrqCWSfXw74WfFNtggpyJ4D9AjUCALskupSGd/8Xc6rXTJ6h0496DTPEh4WNtvwGeDucTCf7IDoySn/9yrOcIDLVxV3xgKpKXUWr6sjtOxSDMuUQYXpBSa6LN4BN1HOk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2XXB5BwO; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="2XXB5BwO" Received: by smtp.kernel.org (Postfix) with ESMTPSA id ED2A11F000FF; Sat, 12 Sep 2026 19:19:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789240796; bh=Q/xTsr3ekqXa68SocLGN6ogK15Ev4EasypJXQuUEdpE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=2XXB5BwO8LJWbXy+wXWqQ8ZPBmS/cQf6zGqS/Am/XTSjvSLOXHCt1jPSMGjV2tm/x mXtLCVq3JvL7Mie4pBBkXoKAEjx2EsBTYdXC78pHbqCmA/a7KpBjV7ME5F5m4Nhvj/ 0T4+T6xgEwOvd4orloJEc6ZhYs+w7aBoq+0Skge8= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Jan Engelhardt , Florian Westphal , =?UTF-8?q?Michal=20Koutn=C3=BD?= , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 5.15 910/935] netfilter: xt_cgroup: Make it independent from net_cls Date: Sat, 12 Sep 2026 09:05:40 +0200 Message-ID: <20260912065547.689098086@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260912065526.833703348@linuxfoundation.org> References: <20260912065526.833703348@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michal Koutný [ Upstream commit 3ba0032afea888d0edebf5ece3c6b36417189b63 ] The xt_group matching supports the default hierarchy since commit c38c4597e4bf3 ("netfilter: implement xt_cgroup cgroup2 path match"). The cgroup v1 matching (based on clsid) and cgroup v2 matching (based on path) are rather independent. Downgrade the Kconfig dependency to mere CONFIG_SOCK_GROUP_DATA so that xt_group can be built even without CONFIG_NET_CLS_CGROUP for path matching. Also add a message for users when they attempt to specify any clsid. Link: https://lists.opensuse.org/archives/list/kernel@lists.opensuse.org/thread/S23NOILB7MUIRHSKPBOQKJHVSK26GP6X/ Cc: Jan Engelhardt Cc: Florian Westphal Signed-off-by: Michal Koutný Signed-off-by: Pablo Neira Ayuso Stable-dep-of: 793d9eda4821 ("netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()") Signed-off-by: Sasha Levin --- net/netfilter/Kconfig | 2 +- net/netfilter/xt_cgroup.c | 17 +++++++++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig index f02ebe4609650..ddfbd897ee43d 100644 --- a/net/netfilter/Kconfig +++ b/net/netfilter/Kconfig @@ -1174,7 +1174,7 @@ config NETFILTER_XT_MATCH_CGROUP tristate '"control group" match support' depends on NETFILTER_ADVANCED depends on CGROUPS - select CGROUP_NET_CLASSID + select SOCK_CGROUP_DATA help Socket/process control group matching allows you to match locally generated packets based on which net_cls control group processes diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c index bfc98719684e2..b182b9e0882b6 100644 --- a/net/netfilter/xt_cgroup.c +++ b/net/netfilter/xt_cgroup.c @@ -23,6 +23,8 @@ MODULE_DESCRIPTION("Xtables: process control group matching"); MODULE_ALIAS("ipt_cgroup"); MODULE_ALIAS("ip6t_cgroup"); +#define NET_CLS_CLASSID_INVALID_MSG "xt_cgroup: classid invalid without net_cls cgroups\n" + static int cgroup_mt_check_v0(const struct xt_mtchk_param *par) { struct xt_cgroup_info_v0 *info = par->matchinfo; @@ -30,6 +32,11 @@ static int cgroup_mt_check_v0(const struct xt_mtchk_param *par) if (info->invert & ~1) return -EINVAL; + if (!IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) { + pr_info(NET_CLS_CLASSID_INVALID_MSG); + return -EINVAL; + } + return 0; } @@ -51,6 +58,11 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par) return -EINVAL; } + if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) { + pr_info(NET_CLS_CLASSID_INVALID_MSG); + return -EINVAL; + } + info->priv = NULL; if (info->has_path) { if (strnlen(info->path, sizeof(info->path)) >= sizeof(info->path)) @@ -86,6 +98,11 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par) return -EINVAL; } + if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) { + pr_info(NET_CLS_CLASSID_INVALID_MSG); + return -EINVAL; + } + info->priv = NULL; if (info->has_path) { if (strnlen(info->path, sizeof(info->path)) >= sizeof(info->path)) -- 2.53.0