-
Pablo Neira Ayuso authored
We have to stop iterating on the rule expressions if the cgroup mismatches. Moreover, make sure a non-full socket from the input path leads us to a crash. Fixes: ce674173 ("netfilter: nft_meta: add cgroup support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
c5035c77