@@ -335,7 +335,8 @@ struct nft_set_estimate {
};
#define NFT_EXPR_MAXATTR 16
-#define NFT_EXPR_SIZE(size) (sizeof(struct nft_expr) + \
+#define NFT_EXPR_SIZE(size) size
+#define NFT_EXPR_FULL_SIZE(size) (sizeof(struct nft_expr) + \
ALIGN(size, __alignof__(struct nft_expr)))
/**
@@ -464,7 +465,8 @@ struct nft_set_elem_expr {
#define nft_setelem_expr_foreach(__expr, __elem_expr, __size) \
for (__expr = nft_setelem_expr_at(__elem_expr, 0), __size = 0; \
__size < (__elem_expr)->size; \
- __size += (__expr)->ops->size, __expr = ((void *)(__expr)) + (__expr)->ops->size)
+ __size += NFT_EXPR_FULL_SIZE((__expr)->ops->size), \
+ __expr = ((void *)(__expr)) + NFT_EXPR_FULL_SIZE((__expr)->ops->size))
#define NFT_SET_EXPR_MAX 2
@@ -940,7 +942,7 @@ static inline struct nft_expr *nft_expr_first(const struct nft_rule *rule)
static inline struct nft_expr *nft_expr_next(const struct nft_expr *expr)
{
- return ((void *)expr) + expr->ops->size;
+ return ((void *)expr) + NFT_EXPR_FULL_SIZE(expr->ops->size);
}
static inline struct nft_expr *nft_expr_last(const struct nft_rule *rule)
@@ -2876,7 +2876,8 @@ static struct nft_expr *nft_expr_init(const struct nft_ctx *ctx,
goto err1;
err = -ENOMEM;
- expr = kzalloc(expr_info.ops->size, GFP_KERNEL_ACCOUNT);
+ expr = kzalloc(NFT_EXPR_FULL_SIZE(expr_info.ops->size),
+ GFP_KERNEL_ACCOUNT);
if (expr == NULL)
goto err2;
@@ -2907,7 +2908,7 @@ int nft_expr_clone(struct nft_expr *dst, struct nft_expr *src)
if (err < 0)
return err;
} else {
- memcpy(dst, src, src->ops->size);
+ memcpy(dst, src, NFT_EXPR_FULL_SIZE(src->ops->size));
}
__module_get(src->ops->type->owner);
@@ -3468,7 +3469,7 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,
NL_SET_BAD_ATTR(extack, tmp);
goto err_release_expr;
}
- size += expr_info[n].ops->size;
+ size += NFT_EXPR_FULL_SIZE(expr_info[n].ops->size);
n++;
}
}
@@ -5526,7 +5527,8 @@ int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,
int err, i, k;
for (i = 0; i < set->num_exprs; i++) {
- expr = kzalloc(set->exprs[i]->ops->size, GFP_KERNEL_ACCOUNT);
+ expr = kzalloc(NFT_EXPR_FULL_SIZE(set->exprs[i]->ops->size),
+ GFP_KERNEL_ACCOUNT);
if (!expr)
goto err_expr;
@@ -5562,7 +5564,7 @@ static int nft_set_elem_expr_setup(struct nft_ctx *ctx,
if (err < 0)
goto err_elem_expr_setup;
- elem_expr->size += expr_array[i]->ops->size;
+ elem_expr->size += NFT_EXPR_FULL_SIZE(expr_array[i]->ops->size);
nft_expr_destroy(ctx, expr_array[i]);
expr_array[i] = NULL;
}
@@ -5929,7 +5931,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,
if (num_exprs) {
for (i = 0; i < num_exprs; i++)
- size += expr_array[i]->ops->size;
+ size += NFT_EXPR_FULL_SIZE(expr_array[i]->ops->size);
nft_set_ext_add_length(&tmpl, NFT_SET_EXT_EXPRESSIONS,
sizeof(struct nft_set_elem_expr) +
@@ -8356,9 +8358,9 @@ static bool nft_expr_reduce(struct nft_regs_track *track,
static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain)
{
+ unsigned int size, expr_size, data_size;
const struct nft_expr *expr, *last;
struct nft_regs_track track = {};
- unsigned int size, data_size;
void *data, *data_boundary;
struct nft_rule_dp *prule;
struct nft_rule *rule;
@@ -8404,11 +8406,12 @@ static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *cha
continue;
}
- if (WARN_ON_ONCE(data + expr->ops->size > data_boundary))
+ expr_size = NFT_EXPR_FULL_SIZE(expr->ops->size);
+ if (WARN_ON_ONCE(data + expr_size > data_boundary))
return -ENOMEM;
- memcpy(data + size, expr, expr->ops->size);
- size += expr->ops->size;
+ memcpy(data + size, expr, expr_size);
+ size += expr_size;
}
if (WARN_ON_ONCE(size >= 1 << 12))
return -ENOMEM;
Prepare for expressions of different size in ruleset blob by storing only the per-expression payload in struct nft_expr_ops' size field instead of a value depending on size of struct nft_expr. Signed-off-by: Phil Sutter <phil@nwl.cc> --- Changes since v3: - Adjust nft_setelem_expr_foreach() and nft_expr_next() accordingly. --- include/net/netfilter/nf_tables.h | 8 +++++--- net/netfilter/nf_tables_api.c | 23 +++++++++++++---------- 2 files changed, 18 insertions(+), 13 deletions(-)