]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level
authorPablo Neira Ayuso <pablo@netfilter.org>
Tue, 26 Nov 2024 10:59:06 +0000 (11:59 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 14 Dec 2024 19:03:03 +0000 (20:03 +0100)
commite227c042580ab065edc610c9ddc9bea691e6fc4d
treeb2f7d4736a80e3ac384102d91434844934e73b47
parentc40c96d98e536fc1daaa125c2332b988615e30a4
netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level

[ Upstream commit b7529880cb961d515642ce63f9d7570869bbbdc3 ]

cgroup maximum depth is INT_MAX by default, there is a cgroup toggle to
restrict this maximum depth to a more reasonable value not to harm
performance. Remove unnecessary WARN_ON_ONCE which is reachable from
userspace.

Fixes: 7f3287db6543 ("netfilter: nft_socket: make cgroupsv2 matching work with namespaces")
Reported-by: syzbot+57bac0866ddd99fe47c0@syzkaller.appspotmail.com
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/netfilter/nft_socket.c