From: Felix Fietkau Subject: netfilter: reduce match memory access Signed-off-by: Felix Fietkau --- net/ipv4/netfilter/ip_tables.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/ipv4/netfilter/ip_tables.c +++ b/net/ipv4/netfilter/ip_tables.c @@ -56,9 +56,9 @@ ip_packet_match(const struct iphdr *ip, if (ipinfo->flags & IPT_F_NO_DEF_MATCH) return true; - if (NF_INVF(ipinfo, IPT_INV_SRCIP, + if (NF_INVF(ipinfo, IPT_INV_SRCIP, ipinfo->smsk.s_addr && (ip->saddr & ipinfo->smsk.s_addr) != ipinfo->src.s_addr) || - NF_INVF(ipinfo, IPT_INV_DSTIP, + NF_INVF(ipinfo, IPT_INV_DSTIP, ipinfo->dmsk.s_addr && (ip->daddr & ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr)) return false;