On Fri, Feb 15, 2019 at 03:33:02PM +0100, Pablo Neira Ayuso wrote: > On Fri, Feb 15, 2019 at 02:15:37PM +0100, Phil Sutter wrote: > > Hi, > > > > On Fri, Feb 15, 2019 at 10:50:42AM +0100, Pablo Neira Ayuso wrote: > > [...] > > > > From the flush path, we can skip requests for deletion of rules that > > > > have been already deleted, ie. we add no transaction since there is > > > > already one in place. > > > > Thanks for the quick fix! > > > > > nft_delrule_by_chain() is always called from flush path. We can apply > > > this smaller fix I think. > > > > > diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c > > > index 5a92f23f179f..4893f248dfdc 100644 > > > --- a/net/netfilter/nf_tables_api.c > > > +++ b/net/netfilter/nf_tables_api.c > > > @@ -313,6 +313,9 @@ static int nft_delrule_by_chain(struct nft_ctx *ctx) > > > int err; > > > > > > list_for_each_entry(rule, &ctx->chain->rules, list) { > > > + if (!nft_is_active_next(ctx->net, rule)) > > > + continue; > > > + > > > err = nft_delrule(ctx, rule); > > > if (err < 0) > > > return err; > > > > Successfully tested with my ebtables-nft bug: > > > > | # ebtables-nft -N foo > > | # ebtables-nft -F > > > > (Batch then contains policy rule delete and chain flush.) > > > > Acked-by: Phil Sutter <phil@xxxxxx> > > OK, I have pushed this out to nf.git. Nice, thanks! If this has soaked into stable for a while, we may drop nft_abort_policy_rule() again, I guess. :) Cheers, Phil