netfilter pull request 23-05-03

-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEN9lkrMBJgcdVAPub1V2XiooUIOQFAmRSv2sACgkQ1V2XiooU
 IOTSpxAAm9Q1CZZbgVkO/alY7VewfM3va+FxL5oeKKbghhy2vnDRQf4hF6TXkDn6
 Qd3e8WJyBGoRixb92cc/OQjDxTNUJN6oJYAlFh6vJ/xyCzcu0Dg95g4toX00BdZK
 1QWUy6XdClKKDfEXoxWCzv8eEuK+pLh6DB12+x30Jrj8qaRybbXoi3YGnMQf4W7h
 y7xi+/0A84UWwmDySrfj53/DPBV+TkGoP6D1ZyMobhI7d+9crhSP4I5JBtXTWVda
 gf4t2dtSKSBBiQXb/z4eEBXe7KaIPOYoVRUUncnho7N40U+rdpVe9D+VrWsPV271
 8eeiuZqLhJxgxsYP6ytIS8g9ZJ+yYxpGfTtpqG6RE9fI3LXnuzqBut8ggc1Xr5xN
 /kh28DMjgqrFBPLnpfAzU+qJATpaGCD/3sD4R+W4Et9CSK5lH9AyLlYKo6po9I4T
 V1aRxh0yXMuM2BHfpZIaFj3gZxgrKooYFnTFFpdNla5FK7PvjX0jLWVbWoM8Cozv
 f/meZv1WepqoXtb98Vo60T8f1KSsu7GArRuTKtBCajHUgxzHduxUOPYZeNAjuC6h
 4kVF2sAeCR4pDIQIBR555wmV8+tikbK9iHDqdO9Nr3R0t0KWpc8j3YjuVhvswyib
 qFzdUZc65n2aYemkxCs4p9LAEElPj/4TNotOc/zNvPQeuZcJkc4=
 =7FnG
 -----END PGP SIGNATURE-----

Merge tag 'nf-23-05-03' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains one Netfilter fix:

1) Restore 'ct state untracked' matching with CONFIG_RETPOLINE=y,
   from Florian Westphal.

* tag 'nf-23-05-03' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: nf_tables: fix ct untracked match breakage
====================

Link: https://lore.kernel.org/r/20230503201143.12310-1-pablo@netfilter.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

net/netfilter/nft_ct_fast.c

@@ -15,10 +15,6 @@ void nft_ct_get_fast_eval(const struct nft_expr *expr,
 	unsigned int state;
 
 	ct = nf_ct_get(pkt->skb, &ctinfo);
-	if (!ct) {
-		regs->verdict.code = NFT_BREAK;
-		return;
-	}
 
 	switch (priv->key) {
 	case NFT_CT_STATE:
@@ -30,6 +26,16 @@ void nft_ct_get_fast_eval(const struct nft_expr *expr,
 			state = NF_CT_STATE_INVALID_BIT;
 		*dest = state;
 		return;
+	default:
+		break;
+	}
+
+	if (!ct) {
+		regs->verdict.code = NFT_BREAK;
+		return;
+	}
+
+	switch (priv->key) {
 	case NFT_CT_DIRECTION:
 		nft_reg_store8(dest, CTINFO2DIR(ctinfo));
 		return;