tree ab43b71812f32ae26ed5915c476c74c55badf905
parent a0071840d2040ea1b27e5a008182b09b88defc15
author Phil Sutter <phil@nwl.cc> 1546187263 +0100
committer Pablo Neira Ayuso <pablo@netfilter.org> 1546984873 +0100

netfilter: nf_tables: Fix for endless loop when dumping ruleset

__nf_tables_dump_rules() stores the current idx value into cb->args[0]
before returning to caller. With multiple chains present, cb->args[0] is
therefore updated after each chain's rules have been traversed. This
though causes the final nf_tables_dump_rules() run (which should return
an skb->len of zero since no rules are left to dump) to continue dumping
rules for each but the first chain. Fix this by moving the cb->args[0]
update to nf_tables_dump_rules().

With no final action to be performed anymore in
__nf_tables_dump_rules(), drop 'out_unfinished' jump label and 'rc'
variable - instead return the appropriate value directly.

Fixes: 241faeceb849c ("netfilter: nf_tables: Speed up selective rule dumps")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>