Re: [nf_tables] netdev chain: DELCHAIN with an exact device name matches a prefix hook and deletes the chain

On 8/11/26 12:29 PM, Wei Fang wrote:
> Hi netfilter-devel,
> 
> The following nf_tables issue was found by metamorphic testing on
> linux-next 7.2.0-rc6-next-20260803 (x86_64) and reproduced on four
> independent VMs.  The reproducer is a single self-contained C program
> that uses only the raw netlink API (no nft CLI involved).
> 
> This report is about netdev-chain device matching: a chain hooked
> via the device prefix "vbug" can be deleted by a DELCHAIN request
> that names the exact device "vbug0", even though that device is not
> a member of the prefix hook.
> 
> Problem
> -------
> A chain hooked via the device prefix vbug (covering vbug0 and
> vbug1) can be deleted by specifying the exact name vbug0 in the
> DELCHAIN request - a device that is not a member of the prefix hook.
> Deleting by a non-member name must fail with -ENOENT; instead it
> succeeds and the whole chain is removed.
> 

I am investigating this and testing a possible patch. I also verified 
this cannot happen with nft.

Thanks,
Fernando.