[PATCH] netfilter: Fix iptables userspace compatibility breakage

ip_tables failed to recognize IPT_RETURN because it was defined relative
to NF_MAX_VERDICT (which changed) and returned it to nf_iterate(). The
old value of IPT_RETURN matches NF_REPEAT, so the hook was called again
and again.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

include/linux/netfilter_arp/arp_tables.h

@@ -154,7 +154,7 @@ struct arpt_entry
 #define ARPT_CONTINUE 0xFFFFFFFF
 
 /* For standard target */
-#define ARPT_RETURN (-NF_MAX_VERDICT - 1)
+#define ARPT_RETURN (-NF_REPEAT - 1)
 
 /* The argument to ARPT_SO_GET_INFO */
 struct arpt_getinfo

include/linux/netfilter_ipv4/ip_tables.h

@@ -166,7 +166,7 @@ struct ipt_entry
 #define IPT_CONTINUE 0xFFFFFFFF
 
 /* For standard target */
-#define IPT_RETURN (-NF_MAX_VERDICT - 1)
+#define IPT_RETURN (-NF_REPEAT - 1)
 
 /* TCP matching stuff */
 struct ipt_tcp

include/linux/netfilter_ipv6/ip6_tables.h

@@ -166,7 +166,7 @@ struct ip6t_entry
 #define IP6T_CONTINUE 0xFFFFFFFF
 
 /* For standard target */
-#define IP6T_RETURN (-NF_MAX_VERDICT - 1)
+#define IP6T_RETURN (-NF_REPEAT - 1)
 
 /* TCP matching stuff */
 struct ip6t_tcp