2 files changed, 6 insertions, 4 deletions

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 71b76ade00..9aa22398b3 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -358,6 +358,7 @@ static int mark_source_chains(struct xt_table_info *newinfo,
                 for (;;) {
                         struct arpt_standard_target *t
                                 = (void *)arpt_get_target(e);
+                        int visited = e->comefrom & (1 << hook);
 
                         if (e->comefrom & (1 << NF_ARP_NUMHOOKS)) {
                                 printk("arptables: loop hook %u pos %u %08X.\n",
@@ -368,11 +369,11 @@ static int mark_source_chains(struct xt_table_info *newinfo,
                                 |= ((1 << hook) | (1 << NF_ARP_NUMHOOKS));
 
                         /* Unconditional return/END. */
-                        if (e->target_offset == sizeof(struct arpt_entry)
+                        if ((e->target_offset == sizeof(struct arpt_entry)
                             && (strcmp(t->target.u.user.name,
                                        ARPT_STANDARD_TARGET) == 0)
                             && t->verdict < 0
-                            && unconditional(&e->arp)) {
+                            && unconditional(&e->arp)) || visited) {
                                 unsigned int oldpos, size;
 
                                 if (t->verdict < -NF_MAX_VERDICT - 1) {
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 83ebbeb80b..09696f16aa 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -384,6 +384,7 @@ mark_source_chains(struct xt_table_info *newinfo,
                 for (;;) {
                         struct ipt_standard_target *t
                                 = (void *)ipt_get_target(e);
+                        int visited = e->comefrom & (1 << hook);
 
                         if (e->comefrom & (1 << NF_IP_NUMHOOKS)) {
                                 printk("iptables: loop hook %u pos %u %08X.\n",
@@ -394,11 +395,11 @@ mark_source_chains(struct xt_table_info *newinfo,
                                 |= ((1 << hook) | (1 << NF_IP_NUMHOOKS));
 
                         /* Unconditional return/END. */
-                        if (e->target_offset == sizeof(struct ipt_entry)
+                        if ((e->target_offset == sizeof(struct ipt_entry)
                             && (strcmp(t->target.u.user.name,
                                        IPT_STANDARD_TARGET) == 0)
                             && t->verdict < 0
-                            && unconditional(&e->ip)) {
+                            && unconditional(&e->ip)) || visited) {
                                 unsigned int oldpos, size;
 
                                 if (t->verdict < -NF_MAX_VERDICT - 1) {