From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Mon, 2 Sep 2024 23:06:41 +0000 (+0200)
Subject: netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
X-Git-Tag: v6.12-rc1~232^2~76^2~8
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e0c47281723f301894c14e6f5cd5884fdfb813f9;p=thirdparty%2Fkernel%2Flinux.git

netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire

Element timeout that is below CONFIG_HZ never expires because the
timeout extension is not allocated given that nf_msecs_to_jiffies64()
returns 0. Set timeout to the minimum value to honor timeout.

Fixes: 8e1102d5a159 ("netfilter: nf_tables: support timeouts larger than 23 days")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index b6547fe22bd8d..b49fcd7148d37 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4593,7 +4593,7 @@ int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)
 		return -ERANGE;
 
 	ms *= NSEC_PER_MSEC;
-	*result = nsecs_to_jiffies64(ms);
+	*result = nsecs_to_jiffies64(ms) ? : !!ms;
 	return 0;
 }