Florian Westphal <fw@xxxxxxxxx> wrote: > ѽ҉ᶬḳ℠ <vtol@xxxxxxx> wrote: > kernel part of the bug: > .... > nft_trace_packet(&info, basechain, NULL, NFT_TRACETYPE_POLICY); > > if (static_branch_unlikely(&nft_counters_enabled)) > nft_update_chain_stats(basechain, pkt); > > return nft_base_chain(basechain)->policy; > } > > so when we emit 'trace' message, verdict register still contains > 'continue', because we return ->policy but don't update internal > register beforehand. I take this back, this is BS. Kernel is fine, its a pure userspace bug. Will send a fix in a minute, thanks for reporting. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
