diff options
| author | Florian Westphal <fw@strlen.de> | 2023-06-21 10:36:26 +0200 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2023-08-22 15:14:32 +0200 |
| commit | 169384fbe8513185499bcbb817d198e6a63eb37e (patch) | |
| tree | 27ef69a32f7459a495790d3cf35788d2bde07de5 /net/netfilter/nf_tables_api.c | |
| parent | aa222dd190d69ca8e0e2b990ec171c67a74d5383 (diff) | |
netfilter: nf_tables: allow loop termination for pending fatal signal
abort early so task can exit faster if a fatal signal is pending,
no need to continue validation in that case.
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'net/netfilter/nf_tables_api.c')
| -rw-r--r-- | net/netfilter/nf_tables_api.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 3e841e45f2c0..f00a1dff85e8 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3675,6 +3675,9 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain) return -EMLINK; list_for_each_entry(rule, &chain->rules, list) { + if (fatal_signal_pending(current)) + return -EINTR; + if (!nft_is_active_next(ctx->net, rule)) continue; @@ -10479,6 +10482,9 @@ static int nf_tables_check_loops(const struct nft_ctx *ctx, if (ctx->chain == chain) return -ELOOP; + if (fatal_signal_pending(current)) + return -EINTR; + list_for_each_entry(rule, &chain->rules, list) { nft_rule_for_each_expr(expr, last, rule) { struct nft_immediate_expr *priv; |