Like NFQNL_MSG_VERDICT_BATCH do, we should also reject the verdict request when the portid is not same with the initial portid(maybe from another process).
Unified · Split
| @@ -1145,10 +1145,8 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl, · 1144 unmodified lines | |||
| 1145 | struct nfnl_queue_net *q = nfnl_queue_pernet(net); | 1145 | struct nfnl_queue_net *q = nfnl_queue_pernet(net); |
| 1146 | int err; | 1146 | int err; |
| 1147 | 1147 | ||
| 1148 | queue = instance_lookup(q, queue_num); | 1148 | queue = verdict_instance_lookup(q, queue_num, |
| 1149 | if (!queue) | 1149 | NETLINK_CB(skb).portid); |
| 1150 | queue = verdict_instance_lookup(q, queue_num, | ||
| 1151 | NETLINK_CB(skb).portid); | ||
| 1152 | if (IS_ERR(queue)) | 1150 | if (IS_ERR(queue)) |
| 1153 | return PTR_ERR(queue); | 1151 | return PTR_ERR(queue); |
| 1154 | 1152 | ||