From: Eric Paris Date: Fri, 12 Nov 2010 07:26:06 +0000 (+0100) Subject: netfilter: NF_HOOK_COND has wrong conditional X-Git-Tag: v2.6.37-rc2~20^2~21^2~1 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ac5aa2e3332ec04889074afdbd1479424d0227a5;p=pandora-kernel.git netfilter: NF_HOOK_COND has wrong conditional The NF_HOOK_COND returns 0 when it shouldn't due to what I believe to be an error in the code as the order of operations is not what was intended. C will evalutate == before =. Which means ret is getting set to the bool result, rather than the return value of the function call. The code says if (ret = function() == 1) when it meant to say: if ((ret = function()) == 1) Normally the compiler would warn, but it doesn't notice it because its a actually complex conditional and so the wrong code is wrapped in an explict set of () [exactly what the compiler wants you to do if this was intentional]. Fixing this means that errors when netfilter denies a packet get propagated back up the stack rather than lost. Problem introduced by commit 2249065f (netfilter: get rid of the grossness in netfilter.h). Signed-off-by: Eric Paris Cc: stable@kernel.org Signed-off-by: Patrick McHardy --- Reading git-diff-tree failed