3.16.66-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso pablo@netfilter.org
commit 23b7ca4f745f21c2b9cfcb67fdd33733b3ae7e66 upstream.
Flush after rule deletion bogusly hits -ENOENT. Skip rules that have been already from nft_delrule_by_chain() which is always called from the flush path.
Fixes: cf9dc09d0949 ("netfilter: nf_tables: fix missing rules flushing per table") Reported-by: Phil Sutter phil@nwl.cc Acked-by: Phil Sutter phil@nwl.cc Signed-off-by: Pablo Neira Ayuso pablo@netfilter.org [bwh: Backported to 3.16: - Use nft_rule_is_active_next() instead of nft_is_active_next() - Adjust context] Signed-off-by: Ben Hutchings ben@decadent.org.uk --- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
--- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1897,6 +1897,9 @@ static int nf_table_delrule_by_chain(str int err;
list_for_each_entry(rule, &ctx->chain->rules, list) { + if (!nft_rule_is_active_next(ctx->net, rule)) + continue; + err = nf_tables_delrule_one(ctx, rule); if (err < 0) return err;