4 files changed, 20 insertions, 11 deletions

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 08c005ce56e9..4e82a4c49912 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -150,6 +150,7 @@ static inline void nft_data_debug(const struct nft_data *data)
  *      @portid: netlink portID of the original message
  *      @seq: netlink sequence number
  *      @family: protocol family
+ *      @level: depth of the chains
  *      @report: notify via unicast netlink message
  */
 struct nft_ctx {
@@ -160,6 +161,7 @@ struct nft_ctx {
         u32                             portid;
         u32                             seq;
         u8                              family;
+        u8                              level;
         bool                            report;
 };
 
@@ -865,7 +867,6 @@ enum nft_chain_flags {
  *      @table: table that this chain belongs to
  *      @handle: chain handle
  *      @use: number of jump references to this chain
- *      @level: length of longest path to this chain
  *      @flags: bitmask of enum nft_chain_flags
  *      @name: name of the chain
  */
@@ -878,7 +879,6 @@ struct nft_chain {
         struct nft_table                *table;
         u64                             handle;
         u32                             use;
-        u16                             level;
         u8                              flags:6,
                                         genmask:2;
         char                            *name;
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 896d4a36081d..d41fa2c82f14 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -75,6 +75,7 @@ static void nft_ctx_init(struct nft_ctx *ctx,
 {
         ctx->net        = net;
         ctx->family     = family;
+        ctx->level      = 0;
         ctx->table      = table;
         ctx->chain      = chain;
         ctx->nla        = nla;
@@ -2384,6 +2385,9 @@ int nft_chain_validate(const struct nft_ctx *ctx, const struct nft_chain *chain)
         struct nft_rule *rule;
         int err;
 
+        if (ctx->level == NFT_JUMP_STACK_SIZE)
+                return -EMLINK;
+
         list_for_each_entry(rule, &chain->rules, list) {
                 if (!nft_is_active_next(ctx->net, rule))
                         continue;
@@ -6837,13 +6841,6 @@ int nft_validate_register_store(const struct nft_ctx *ctx,
                         err = nf_tables_check_loops(ctx, data->verdict.chain);
                         if (err < 0)
                                 return err;
-
-                        if (ctx->chain->level + 1 >
-                            data->verdict.chain->level) {
-                                if (ctx->chain->level + 1 == NFT_JUMP_STACK_SIZE)
-                                        return -EMLINK;
-                                data->verdict.chain->level = ctx->chain->level + 1;
-                        }
                 }
 
                 return 0;
diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
index 15adf8ca82c3..0777a93211e2 100644
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -98,6 +98,7 @@ static int nft_immediate_validate(const struct nft_ctx *ctx,
                                   const struct nft_data **d)
 {
         const struct nft_immediate_expr *priv = nft_expr_priv(expr);
+        struct nft_ctx *pctx = (struct nft_ctx *)ctx;
         const struct nft_data *data;
         int err;
 
@@ -109,9 +110,11 @@ static int nft_immediate_validate(const struct nft_ctx *ctx,
         switch (data->verdict.code) {
         case NFT_JUMP:
         case NFT_GOTO:
+                pctx->level++;
                 err = nft_chain_validate(ctx, data->verdict.chain);
                 if (err < 0)
                         return err;
+                pctx->level--;
                 break;
         default:
                 break;
diff --git a/net/netfilter/nft_lookup.c b/net/netfilter/nft_lookup.c
index 42e6fadf1417..c2a1d84cdfc4 100644
--- a/net/netfilter/nft_lookup.c
+++ b/net/netfilter/nft_lookup.c
@@ -155,7 +155,9 @@ static int nft_lookup_validate_setelem(const struct nft_ctx *ctx,
                                        struct nft_set_elem *elem)
 {
         const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
+        struct nft_ctx *pctx = (struct nft_ctx *)ctx;
         const struct nft_data *data;
+        int err;
 
         if (nft_set_ext_exists(ext, NFT_SET_EXT_FLAGS) &&
             *nft_set_ext_flags(ext) & NFT_SET_ELEM_INTERVAL_END)
@@ -165,10 +167,17 @@ static int nft_lookup_validate_setelem(const struct nft_ctx *ctx,
         switch (data->verdict.code) {
         case NFT_JUMP:
         case NFT_GOTO:
-                return nft_chain_validate(ctx, data->verdict.chain);
+                pctx->level++;
+                err = nft_chain_validate(ctx, data->verdict.chain);
+                if (err < 0)
+                        return err;
+                pctx->level--;
+                break;
         default:
-                return 0;
+                break;
         }
+
+        return 0;
 }
 
 static int nft_lookup_validate(const struct nft_ctx *ctx,