Messages in this thread Patch in this message | | | From | Ben Hutchings <> | Date | Sat, 27 Apr 2019 16:13:09 +0100 | Subject | [PATCH 3.16 161/202] netfilter: nf_tables: fix flush after rule deletion in the same batch |
| |
3.16.66-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit 23b7ca4f745f21c2b9cfcb67fdd33733b3ae7e66 upstream.
Flush after rule deletion bogusly hits -ENOENT. Skip rules that have been already from nft_delrule_by_chain() which is always called from the flush path.
Fixes: cf9dc09d0949 ("netfilter: nf_tables: fix missing rules flushing per table") Reported-by: Phil Sutter <phil@nwl.cc> Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> [bwh: Backported to 3.16: - Use nft_rule_is_active_next() instead of nft_is_active_next() - Adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> --- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
--- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1897,6 +1897,9 @@ static int nf_table_delrule_by_chain(str int err; list_for_each_entry(rule, &ctx->chain->rules, list) { + if (!nft_rule_is_active_next(ctx->net, rule)) + continue; + err = nf_tables_delrule_one(ctx, rule); if (err < 0) return err;
| |