Re: [PATCH nf] netfilter: nf_tables: cancel register tracking if .reduce is not defined

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Mar 10, 2022 at 11:37:37PM +0100, Pablo Neira Ayuso wrote:
> Cancel all register tracking if the the reduce function is not defined.
> Add missing reduce function to cmp since this is a read-only operation.
> 
> This unbreaks selftests/netfilter/nft_nat_zones.sh.
> 
> Fixes: 12e4ecfa244b ("netfilter: nf_tables: add register tracking infrastructure")
> Suggested-by: Florian Westphal <fw@strlen.de>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---

Actually intended to nf-next.

>  net/netfilter/nf_tables_api.c | 2 ++
>  net/netfilter/nft_cmp.c       | 8 ++++++++
>  2 files changed, 10 insertions(+)
> 
> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
> index c86748b3873b..861a3a36024a 100644
> --- a/net/netfilter/nf_tables_api.c
> +++ b/net/netfilter/nf_tables_api.c
> @@ -8311,6 +8311,8 @@ static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *cha
>  			    expr->ops->reduce(&track, expr)) {
>  				expr = track.cur;
>  				continue;
> +			} else if (expr->ops->reduce == NULL) {
> +				memset(track.regs, 0, sizeof(track.regs));
>  			}
>  
>  			if (WARN_ON_ONCE(data + expr->ops->size > data_boundary))
> diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
> index 47b6d05f1ae6..23bef7df48f1 100644
> --- a/net/netfilter/nft_cmp.c
> +++ b/net/netfilter/nft_cmp.c
> @@ -187,12 +187,19 @@ static int nft_cmp_offload(struct nft_offload_ctx *ctx,
>  	return __nft_cmp_offload(ctx, flow, priv);
>  }
>  
> +static bool nft_cmp_reduce(struct nft_regs_track *track,
> +			   const struct nft_expr *expr)
> +{
> +	return false;
> +}
> +
>  static const struct nft_expr_ops nft_cmp_ops = {
>  	.type		= &nft_cmp_type,
>  	.size		= NFT_EXPR_SIZE(sizeof(struct nft_cmp_expr)),
>  	.eval		= nft_cmp_eval,
>  	.init		= nft_cmp_init,
>  	.dump		= nft_cmp_dump,
> +	.reduce		= nft_cmp_reduce,
>  	.offload	= nft_cmp_offload,
>  };
>  
> @@ -269,6 +276,7 @@ const struct nft_expr_ops nft_cmp_fast_ops = {
>  	.eval		= NULL,	/* inlined */
>  	.init		= nft_cmp_fast_init,
>  	.dump		= nft_cmp_fast_dump,
> +	.reduce		= nft_cmp_reduce,
>  	.offload	= nft_cmp_fast_offload,
>  };
>  
> -- 
> 2.30.2
>