[PATCH] netfilter: cthelper: report absent filtered deletes

nfnl_cthelper_del() returns success when the helper list is empty, even
if the request names a helper that does not exist. The same request
returns -ENOENT when an unrelated helper is present. This makes the
ACK depend on unrelated list contents.

The empty-list success case is needed only for an unfiltered flush.
Return success when a helper was deleted or when neither a name nor a
tuple filter was supplied. Otherwise return the existing -ENOENT.

Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure")
Signed-off-by: Baek Kyu, Kim <redacted>
---
An arm64 QEMU/KVM kernel received NETLINK_NETFILTER cthelper DEL,
NEW and GET requests. Deleting an absent named helper from an empty
list returned success before the change and -ENOENT afterward.
Deleting an existing helper and an unfiltered empty-list flush kept
their success responses. Tuple-only deletion and packet traffic were
not exercised.

 net/netfilter/nfnetlink_cthelper.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index 5b6a09f46903f..774edb07fb1a3 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c

@@ -700,7 +700,7 @@ static int nfnl_cthelper_del(struct sk_buff *skb, const struct nfnl_info *info,
 	struct nf_conntrack_tuple tuple;
 	bool tuple_set = false, found = false;
 	struct nfnl_cthelper *nlcth, *n;
-	int j = 0, ret;
+	int ret;
 
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;

@@ -719,7 +719,6 @@ static int nfnl_cthelper_del(struct sk_buff *skb, const struct nfnl_info *info,
 	ret = -ENOENT;
 	list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) {
 		cur = nlcth->helper;
-		j++;
 
 		if (helper_name &&
 		    strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN))

@@ -738,7 +737,9 @@ static int nfnl_cthelper_del(struct sk_buff *skb, const struct nfnl_info *info,
 	}
 
 	/* Make sure we return success if we flush and there is no helpers */
-	return (found || j == 0) ? 0 : ret;
+	if (found || (!helper_name && !tuple_set))
+		return 0;
+	return ret;
 }
 
 static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = {

-- 
2.55.0