[PATCH v12 nf-next 5/7] netfilter: nft_flow_offload: nft_flow_offload_eval: check thoff==0
From: Eric Woudstra <hidden>
Date: 2026-07-07 09:11:22
Also in:
bridge, netfilter-devel
Subsystem:
netfilter, networking [general], the rest · Maintainers:
Pablo Neira Ayuso, Florian Westphal, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
In case of flow through bridge, when evaluating traffic with double vlan, pppoe and pppoe-in-q. In this case thoff will be valid only when meta has been processed. If meta was not processed in nftables, thoff is zero. Signed-off-by: Eric Woudstra <redacted> --- net/netfilter/nft_flow_offload.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
index f8c7f9f631e48..4f68fb64f1657 100644
--- a/net/netfilter/nft_flow_offload.c
+++ b/net/netfilter/nft_flow_offload.c@@ -59,7 +59,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, struct flow_offload *flow; enum ip_conntrack_dir dir; struct nf_conn *ct; - int ret; + int ret, thoff; if (nft_flow_offload_skip(pkt->skb, nft_pf(pkt))) goto out;
@@ -70,8 +70,11 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) { case IPPROTO_TCP: - tcph = skb_header_pointer(pkt->skb, nft_thoff(pkt), - sizeof(_tcph), &_tcph); + thoff = nft_thoff(pkt); + if (thoff == 0) + goto out; + tcph = skb_header_pointer(pkt->skb, thoff, sizeof(_tcph), + &_tcph); if (unlikely(!tcph || tcph->fin || tcph->rst || !nf_conntrack_tcp_established(ct))) goto out;
--
2.53.0