Patch "netfilter: nft_dynset: continue to next expr if _OP_ADD succeeded" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

netfilter: nft_dynset: continue to next expr if _OP_ADD succeeded

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
netfilter-nft_dynset-continue-to-next-expr-if-_op_add-succeeded.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Liping Zhang <[email protected]>
Date: Sun, 23 Apr 2017 18:29:30 +0800
Subject: netfilter: nft_dynset: continue to next expr if _OP_ADD succeeded

From: Liping Zhang <[email protected]>

[ Upstream commit 277a292835c196894ef895d5e1fd6170bb916f55 ]

Currently, after adding the following nft rules:

  # nft add set x target1 { type ipv4_addr \; flags timeout \;}
  # nft add rule x y set add ip daddr timeout 1d @target1 counter

the counters will always be zero despite of the elements are added to the dynamic set "target1" or not, as we will break the nft expr traversal unconditionally:

  # nft list ruleset
  ...
  set target1 {
      ...
      elements = { 8.8.8.8 expires 23h59m53s}
  }
  chain output {
      ...
      set add ip daddr timeout 1d @target1 counter packets 0 bytes 0
                                                           ^       ^
      ...
  }

Since we add the elements to the set successfully, we should continue to the next expression.

Additionally, if elements are added to "flow table" successfully, we will _always_ continue to the next expr, even if the operation is _OP_ADD. So it's better to keep them to be consistent.

---
 net/netfilter/nft_dynset.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

@@ -82,8 +82,7 @@ static void nft_dynset_eval(const struct
 		    nft_set_ext_exists(ext, NFT_SET_EXT_EXPIRATION)) {
 			timeout = priv->timeout ? : set->timeout;
 			*nft_set_ext_expiration(ext) = jiffies + timeout;
-		} else if (sexpr == NULL)
-			goto out;
+		}
 
 		if (sexpr != NULL)
 			sexpr->ops->eval(sexpr, regs, pkt);

@@ -92,7 +91,7 @@ static void nft_dynset_eval(const struct
 			regs->verdict.code = NFT_BREAK;
 		return;
 	}
-out:
+
 	if (!priv->invert)
 		regs->verdict.code = NFT_BREAK;
 }

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/netfilter-nf_ct_helper-permit-cthelpers-with-different-names-via-nfnetlink.patch queue-4.9/netfilter-xt_ct-fix-refcnt-leak-on-error-path.patch queue-4.9/netfilter-nft_dynset-continue-to-next-expr-if-_op_add-succeeded.patch