Commit 7a4b6140 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso
Browse files

netfilter: nft_flow_offload: update tcp state flags under lock 



The conntrack entry is already public, there is a small chance that another
CPU is handling a packet in reply direction and racing with the tcp state
update.

Move this under ct spinlock.

This is done once, when ct is about to be offloaded, so this should
not result in a noticeable performance hit.

Fixes: 8437a620 ("netfilter: nft_flow_offload: set liberal tracking mode for tcp")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent d9d7b489

net/netfilter/nft_flow_offload.c

+11 −5
Original line number Diff line number Diff line
@@ -289,6 +289,15 @@ static bool nft_flow_offload_skip(struct sk_buff *skb, int family) 
	return false;

}



static void flow_offload_ct_tcp(struct nf_conn *ct)

{

	/* conntrack will not see all packets, disable tcp window validation. */

	spin_lock_bh(&ct->lock);

	ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;

	ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;

	spin_unlock_bh(&ct->lock);

}



static void nft_flow_offload_eval(const struct nft_expr *expr,

				  struct nft_regs *regs,

				  const struct nft_pktinfo *pkt)
@@ -356,11 +365,8 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, 
		goto err_flow_alloc;



	flow_offload_route_init(flow, &route);



	if (tcph) {

		ct->proto.tcp.seen[0].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;

		ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;

	}

	if (tcph)

		flow_offload_ct_tcp(ct);



	__set_bit(NF_FLOW_HW_BIDIRECTIONAL, &flow->flags);

	ret = flow_offload_add(flowtable, flow);