netfilter: nft_socket: make cgroup match work in input too
authorFlorian Westphal <fw@strlen.de>
Sat, 9 Apr 2022 11:20:19 +0000 (13:20 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Mon, 11 Apr 2022 10:12:46 +0000 (12:12 +0200)
commit05ae2fba821c4d122ab4ba3e52144e21586c4010
treef5e9df44d3007aa1ea626be40668c707af2bcff4
parente8a64bbaaad1f6548cec5508297bc6d45e8ab69e
netfilter: nft_socket: make cgroup match work in input too

cgroupv2 helper function ignores the already-looked up sk
and uses skb->sk instead.

Just pass sk from the calling function instead; this will
make cgroup matching work for udp and tcp in input even when
edemux did not set skb->sk already.

Fixes: e0bb96db96f8 ("netfilter: nft_socket: add support for cgroupsv2")
Signed-off-by: Florian Westphal <fw@strlen.de>
Tested-by: Topi Miettinen <toiwoton@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nft_socket.c