2 files changed, 6 insertions, 2 deletions

diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 03317c8d4077..1893837b3966 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -33,6 +33,8 @@
 
 #define NF_QUEUE_NR(x) ((((x) << NF_VERDICT_BITS) & NF_VERDICT_QMASK) | NF_QUEUE)
 
+#define NF_DROP_ERR(x) (((-x) << NF_VERDICT_BITS) | NF_DROP)
+
 /* only for userspace compatibility */
 #ifndef __KERNEL__
 /* Generic cache responses from hook functions.
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 85dabb86be6f..32fcbe290c04 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -173,9 +173,11 @@ next_hook:
                              outdev, &elem, okfn, hook_thresh);
         if (verdict == NF_ACCEPT || verdict == NF_STOP) {
                 ret = 1;
-        } else if (verdict == NF_DROP) {
+        } else if ((verdict & NF_VERDICT_MASK) == NF_DROP) {
                 kfree_skb(skb);
-                ret = -EPERM;
+                ret = -(verdict >> NF_VERDICT_BITS);
+                if (ret == 0)
+                        ret = -EPERM;
         } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
                 if (!nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
                               verdict >> NF_VERDICT_BITS))