From 542a074a1fd81a2604fc44165173dbf69b2400bd Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 12 Mar 2025 22:51:00 +0900 Subject: [PATCH] netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level BugLink: https://bugs.launchpad.net/bugs/2102118 [ Upstream commit b7529880cb961d515642ce63f9d7570869bbbdc3 ] cgroup maximum depth is INT_MAX by default, there is a cgroup toggle to restrict this maximum depth to a more reasonable value not to harm performance. Remove unnecessary WARN_ON_ONCE which is reachable from userspace. Fixes: 7f3287db6543 ("netfilter: nft_socket: make cgroupsv2 matching work with namespaces") Reported-by: syzbot+57bac0866ddd99fe47c0@syzkaller.appspotmail.com Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin CVE-2024-56783 Signed-off-by: Koichiro Den Signed-off-by: Stefan Bader --- net/netfilter/nft_socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c index 0a8883a93e83..187b667bad6c 100644 --- a/net/netfilter/nft_socket.c +++ b/net/netfilter/nft_socket.c @@ -68,7 +68,7 @@ static noinline int nft_socket_cgroup_subtree_level(void) cgroup_put(cgrp); - if (WARN_ON_ONCE(level > 255)) + if (level > 255) return -ERANGE; if (WARN_ON_ONCE(level < 0))