The delete flowtable command does not create a transaction if the
NFTA_FLOWTABLE_HOOK attribute is specified, hence, the flowtable
is never deleted.
Fixes: abadb2f865d7 ("netfilter: nf_tables: delete devices from flowtable")
Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx>
---
net/netfilter/nf_tables_api.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 224c8e537cb3..6b97a0c7b6d3 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -7090,6 +7090,7 @@ static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
const struct nlattr *attr;
struct nft_table *table;
struct nft_ctx ctx;
+ int err;
if (!nla[NFTA_FLOWTABLE_TABLE] ||
(!nla[NFTA_FLOWTABLE_NAME] &&
@@ -7118,8 +7119,11 @@ static int nf_tables_delflowtable(struct net *net, struct sock *nlsk,
nft_ctx_init(&ctx, net, skb, nlh, family, table, NULL, nla);
- if (nla[NFTA_FLOWTABLE_HOOK])
- return nft_delflowtable_hook(&ctx, flowtable);
+ if (nla[NFTA_FLOWTABLE_HOOK]) {
+ err = nft_delflowtable_hook(&ctx, flowtable);
+ if (err < 0)
+ return err;
+ }
if (flowtable->use > 0) {
NL_SET_BAD_ATTR(extack, attr);
--
2.20.1
