From: Florian Westphal <fw@strlen.de>
Date: Thu, 16 Apr 2026 10:01:22 +0000 (+0200)
Subject: tests: shell: add test for buggy catchall element abort path
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;p=thirdparty%2Fnftables.git

tests: shell: add test for buggy catchall element abort path

Kernel fails to unwind state of all pending catchall elements, check for
this bug.

Signed-off-by: Florian Westphal <fw@strlen.de>
---

diff --git a/tests/shell/testcases/maps/dumps/map_catchall_refcount_underflow.nodump b/tests/shell/testcases/maps/dumps/map_catchall_refcount_underflow.nodump
new file mode 100644
index 00000000..e69de29b
diff --git a/tests/shell/testcases/maps/map_catchall_refcount_underflow b/tests/shell/testcases/maps/map_catchall_refcount_underflow
new file mode 100755
index 00000000..e0c90a66
--- /dev/null
+++ b/tests/shell/testcases/maps/map_catchall_refcount_underflow
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+# NFT_TEST_REQUIRES(NFT_TEST_HAVE_catchall_element)
+
+# testcase for kernel commit
+# 7cb9a23d7ae4 ("netfilter: nf_tables: always walk all pending catchall elements")
+
+set -e
+$NFT -f - <<EOF
+table inet t {
+        map s {
+                type ipv4_addr : verdict
+                elements = { * : accept }
+        }
+
+        chain c {
+        }
+}
+EOF
+
+$NFT --check -f - <<EOF
+delete element inet t s { * }
+add element inet t s  { * : jump c }
+delete map inet t s
+EOF