netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire

[ Upstream commit e0c47281723f301894c14e6f5cd5884fdfb813f9 ]

Element timeout that is below CONFIG_HZ never expires because the
timeout extension is not allocated given that nf_msecs_to_jiffies64()
returns 0. Set timeout to the minimum value to honor timeout.

Fixes: 8e1102d5a159 ("netfilter: nf_tables: support timeouts larger than 23 days")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index df10a2047bb0ec77b23d5b88b5462b50f3623c0d..c00a9495f3453249e8d3cf91a39633366b484be9 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4153,7 +4153,7 @@ int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
                return -ERANGE;
 
        ms *= NSEC_PER_MSEC;
-       *result = nsecs_to_jiffies64(ms);
+       *result = nsecs_to_jiffies64(ms) ? : !!ms;
        return 0;
 }