When deleting a base chain, iptables-nft simply submits the whole chain
to the kernel, including the NFTA_CHAIN_HOOK attribute. The new code
added by fixed commit then turned this into a chain update, destroying
the hook but not the chain itself.
Detect the situation by checking if the chain's hook list becomes empty
after removing all submitted hooks from it. A base chain without hooks
is pointless, so revert back to deleting the chain.
Note the 'goto err_chain_del_hook', error path takes care of undoing the
hook_list modification and releasing the unused chain_hook.
Fixes: 7d937b107108f ("netfilter: nf_tables: support for deleting devices in an existing netdev chain")
Signed-off-by: Phil Sutter <phil@xxxxxx>
---
net/netfilter/nf_tables_api.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 477c39358da7d..9666c8e891fa7 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2699,6 +2699,11 @@ static int nft_delchain_hook(struct nft_ctx *ctx, struct nft_chain *chain,
list_move(&hook->list, &chain_del_list);
}
+ if (list_empty(&basechain->hook_list)) {
+ err = nft_delchain(ctx);
+ goto err_chain_del_hook;
+ }
+
trans = nft_trans_alloc(ctx, NFT_MSG_DELCHAIN,
sizeof(struct nft_trans_chain));
if (!trans) {
--
2.40.0
