Re: [PATCH net] net/sched: act_ct: Fix ct template allocation for zone 0

On Thu, May 27, 2021 at 12:14:21PM -0400, Ariel Levkovich wrote:
...

I meant if there's no ct_clear action.

Assume we already when through zone X in some previous action.

In such case skb->_nfct has that zone's id.

Now, if we go to zone=0, we skip this entirely, since p->tmpl is NULL :

/* Associate skb with specified zone. */
                if (tmpl) {
                        nf_conntrack_put(skb_nfct(skb));
nf_conntrack_get(&tmpl->ct_general);
                        nf_ct_set(skb, tmpl, IP_CT_NEW);
                }


And then in nf_conntrack_in it continues with the previous zone:

err = nf_conntrack_in(skb, &state)

   calling ->   ret = resolve_normal_ct(tmpl, skb, dataoff,
                                  protonum, state);

           calling -> zone = nf_ct_zone_tmpl(tmpl, skb, &tmp);


I encountered it by accident while running one of our test which was buggy

but due to the zone=0 bug the bug in the test was hidden and test passed.

Once I enabled my fix to alloc templated for zone=0 it was exposed.

The test doesn't use ct_clear between zones.

I see now, thanks. When you had said without ct_clear, I thought only
about the first run through ct. Didn't think there would be this
implicit ct_clear expectation. It could also erase _nfct if zone==0,
but agree, too much especial handling for zone 0.

Seems it needs both fixes then, while this patch is good as is.

Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>