netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it

Add a new helper function to retrieve the next action entry in flow
rule, check if the maximum number of actions is reached, bail out in
such case.

Replace existing opencoded iteration on the action array by this
helper function.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>

diff --git a/include/net/netfilter/nf_tables_offload.h b/include/net/netfilter/nf_tables_offload.h
index 3568b6a2f5f0fcc918311a5b18daf0186b7b1016..14c427891ee6dd62d4bc5af86fbec23eb5203a36 100644 (file)
--- a/include/net/netfilter/nf_tables_offload.h
+++ b/include/net/netfilter/nf_tables_offload.h
@@ -67,6 +67,16 @@ struct nft_flow_rule {
        struct flow_rule        *rule;
 };
 
+static inline struct flow_action_entry *
+nft_flow_action_entry_next(struct nft_offload_ctx *ctx,
+                          struct nft_flow_rule *flow)
+{
+       if (unlikely(ctx->num_actions >= flow->rule->action.num_entries))
+               return NULL;
+
+       return &flow->rule->action.entries[ctx->num_actions++];
+}
+
 void nft_flow_rule_set_addr_type(struct nft_flow_rule *flow,
                                 enum flow_dissector_key_id addr_type);
 

diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
index fab8b9011098f46a00580d2206e9ddb5bb47cbbc..e348fb90b8dc3bdd0159477c00536cb78dfcde8a 100644 (file)
--- a/net/netfilter/nf_dup_netdev.c
+++ b/net/netfilter/nf_dup_netdev.c
@@ -95,7 +95,10 @@ int nft_fwd_dup_netdev_offload(struct nft_offload_ctx *ctx,
        if (!dev)
                return -EOPNOTSUPP;
 
-       entry = &flow->rule->action.entries[ctx->num_actions++];
+       entry = nft_flow_action_entry_next(ctx, flow);
+       if (!entry)
+               return -E2BIG;
+
        entry->id = id;
        entry->dev = dev;
 

diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
index 1b733c7b1b0e7c92d2933c56f62653e6a4d3d72f..d00eb2eb30e4695d0cfb2b2d125b4ca06d658a37 100644 (file)
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -279,7 +279,9 @@ static int nft_immediate_offload_verdict(struct nft_offload_ctx *ctx,
        struct flow_action_entry *entry;
        const struct nft_data *data;
 
-       entry = &flow->rule->action.entries[ctx->num_actions++];
+       entry = nft_flow_action_entry_next(ctx, flow);
+       if (!entry)
+               return -E2BIG;
 
        data = &priv->data;
        switch (data->verdict.code) {