@@ -8311,6 +8311,8 @@ static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *cha
expr->ops->reduce(&track, expr)) {
expr = track.cur;
continue;
+ } else if (expr->ops->reduce == NULL) {
+ memset(track.regs, 0, sizeof(track.regs));
}
if (WARN_ON_ONCE(data + expr->ops->size > data_boundary))
@@ -187,12 +187,19 @@ static int nft_cmp_offload(struct nft_offload_ctx *ctx,
return __nft_cmp_offload(ctx, flow, priv);
}
+static bool nft_cmp_reduce(struct nft_regs_track *track,
+ const struct nft_expr *expr)
+{
+ return false;
+}
+
static const struct nft_expr_ops nft_cmp_ops = {
.type = &nft_cmp_type,
.size = NFT_EXPR_SIZE(sizeof(struct nft_cmp_expr)),
.eval = nft_cmp_eval,
.init = nft_cmp_init,
.dump = nft_cmp_dump,
+ .reduce = nft_cmp_reduce,
.offload = nft_cmp_offload,
};
@@ -269,6 +276,7 @@ const struct nft_expr_ops nft_cmp_fast_ops = {
.eval = NULL, /* inlined */
.init = nft_cmp_fast_init,
.dump = nft_cmp_fast_dump,
+ .reduce = nft_cmp_reduce,
.offload = nft_cmp_fast_offload,
};
@@ -731,6 +731,12 @@ static const struct nfnetlink_subsystem nfnl_compat_subsys = {
static struct nft_expr_type nft_match_type;
+static bool nft_match_reduce(struct nft_regs_track *track,
+ const struct nft_expr *expr)
+{
+ return false;
+}
+
static const struct nft_expr_ops *
nft_match_select_ops(const struct nft_ctx *ctx,
const struct nlattr * const tb[])
@@ -773,6 +779,7 @@ nft_match_select_ops(const struct nft_ctx *ctx,
ops->dump = nft_match_dump;
ops->validate = nft_match_validate;
ops->data = match;
+ ops->reduce = nft_match_reduce;
matchsize = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize));
if (matchsize > NFT_MATCH_LARGE_THRESH) {
@@ -811,6 +818,12 @@ static struct nft_expr_type nft_match_type __read_mostly = {
static struct nft_expr_type nft_target_type;
+static bool nft_target_reduce(struct nft_regs_track *track,
+ const struct nft_expr *expr)
+{
+ return false;
+}
+
static const struct nft_expr_ops *
nft_target_select_ops(const struct nft_ctx *ctx,
const struct nlattr * const tb[])
@@ -862,6 +875,7 @@ nft_target_select_ops(const struct nft_ctx *ctx,
ops->dump = nft_target_dump;
ops->validate = nft_target_validate;
ops->data = target;
+ ops->reduce = nft_target_reduce;
if (family == NFPROTO_BRIDGE)
ops->eval = nft_target_eval_bridge;
Cancel all register tracking if the the reduce function is not defined. Add missing reduce function to cmp and compat since these are a read-only operations. This patch unbreaks selftests/netfilter/nft_nat_zones.sh. Fixes: 12e4ecfa244b ("netfilter: nf_tables: add register tracking infrastructure") Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> --- v2: add nft_match_reduce() and nft_target_reduce() so iptables-nft still benefits from the register tracking infrastructure. net/netfilter/nf_tables_api.c | 2 ++ net/netfilter/nft_cmp.c | 8 ++++++++ net/netfilter/nft_compat.c | 14 ++++++++++++++ 3 files changed, 24 insertions(+)