This is a note to let you know that I've just added the patch titled netfilter: nftables: skip hook overlap logic if flowtable is stale to the 5.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: netfilter-nftables-skip-hook-overlap-logic-if-flowta.patch and it can be found in the queue-5.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit 86599967d855b0c2e4e09b60ca46c196650ce52a Author: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> Date: Wed Mar 17 21:19:57 2021 +0100 netfilter: nftables: skip hook overlap logic if flowtable is stale [ Upstream commit 86fe2c19eec4728fd9a42ba18f3b47f0d5f9fd7c ] If the flowtable has been previously removed in this batch, skip the hook overlap checks. This fixes spurious EEXIST errors when removing and adding the flowtable in the same batch. Signed-off-by: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 978a968d7aed..2e76935db2c8 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -6573,6 +6573,9 @@ static int nft_register_flowtable_net_hooks(struct net *net, list_for_each_entry(hook, hook_list, list) { list_for_each_entry(ft, &table->flowtables, list) { + if (!nft_is_active_next(net, ft)) + continue; + list_for_each_entry(hook2, &ft->hook_list, list) { if (hook->ops.dev == hook2->ops.dev && hook->ops.pf == hook2->ops.pf) {