netfilter_complete() currently rejects any filter attached to a
vhost-backed netdev. The AF_PACKET redirector series needs to attach
filters to vhost-backed TAP devices, so relax the blanket vhost
rejection and keep only the backend-type requirement.

Signed-off-by: Cindy Lu <lulu@redhat.com>
---
 net/filter.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/filter.c b/net/filter.c
index 847dd34698..636586e1f3 100644
--- a/net/filter.c
+++ b/net/filter.c
@@ -264,8 +264,10 @@ static void netfilter_complete(UserCreatable *uc, Error **errp)
     }
 
     if (get_vhost_net(ncs[0])) {
-        error_setg(errp, "Vhost is not supported");
-        return;
+        if (ncs[0]->info->type != NET_CLIENT_DRIVER_TAP) {
+            error_setg(errp, "Vhost filter support requires a TAP backend");
+            return;
+        }
     }
 
     if (strcmp(nf->position, "head") && strcmp(nf->position, "tail")) {
-- 
2.52.0