]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commitdiff
netfilter: nftables: skip hook overlap logic if flowtable is stale
authorPablo Neira Ayuso <pablo@netfilter.org>
Wed, 17 Mar 2021 20:19:57 +0000 (21:19 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Thu, 18 Mar 2021 00:08:54 +0000 (01:08 +0100)
If the flowtable has been previously removed in this batch, skip the
hook overlap checks. This fixes spurious EEXIST errors when removing and
adding the flowtable in the same batch.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_tables_api.c

index 4fcd07f1e925f934603ff5b2ca110a761dbe2f8e..f57f1a6ba96f6c6479ffa696ecd89d277223302f 100644 (file)
@@ -6783,6 +6783,9 @@ static int nft_register_flowtable_net_hooks(struct net *net,
 
        list_for_each_entry(hook, hook_list, list) {
                list_for_each_entry(ft, &table->flowtables, list) {
+                       if (!nft_is_active_next(net, ft))
+                               continue;
+
                        list_for_each_entry(hook2, &ft->hook_list, list) {
                                if (hook->ops.dev == hook2->ops.dev &&
                                    hook->ops.pf == hook2->ops.pf) {