Validating a non-base chain for each register store slows down validation unnecessarily, remove it. Fixes: a654de8fdc18 ("netfilter: nf_tables: fix chain dependency validation") Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 6f35f0b7a33c..bef95cede7b5 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -11846,6 +11846,9 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, if (data != NULL && (data->verdict.code == NFT_GOTO || data->verdict.code == NFT_JUMP)) { + if (!nft_is_base_chain(ctx->chain)) + break; + err = nft_chain_validate(ctx, data->verdict.chain); if (err < 0) return err; -- 2.30.2