Re: [PATCH v12 nf-next 5/7] netfilter: nft_flow_offload: nft_flow_offload_eval: check thoff==0
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: 2026-07-08 09:54:08
Also in:
bridge, netfilter-devel
Hi, On Tue, Jul 07, 2026 at 11:10:43AM +0200, Eric Woudstra wrote:
quoted hunk ↗ jump to hunk
In case of flow through bridge, when evaluating traffic with double vlan, pppoe and pppoe-in-q. In this case thoff will be valid only when meta has been processed. If meta was not processed in nftables, thoff is zero. Signed-off-by: Eric Woudstra <redacted> --- net/netfilter/nft_flow_offload.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c index f8c7f9f631e48..4f68fb64f1657 100644 --- a/net/netfilter/nft_flow_offload.c +++ b/net/netfilter/nft_flow_offload.c@@ -59,7 +59,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, struct flow_offload *flow; enum ip_conntrack_dir dir; struct nf_conn *ct; - int ret; + int ret, thoff; if (nft_flow_offload_skip(pkt->skb, nft_pf(pkt))) goto out;@@ -70,8 +70,11 @@ static void nft_flow_offload_eval(const struct nft_expr *expr, switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) { case IPPROTO_TCP: - tcph = skb_header_pointer(pkt->skb, nft_thoff(pkt), - sizeof(_tcph), &_tcph); + thoff = nft_thoff(pkt); + if (thoff == 0) + goto out;
I addressed this by checking pkt->flags. I promised a helper to Florian to improve readability here, but I still have to come back with such patch. Basically, my assumption is that pkt->flags is unset if no IP packet has been parsed.
+ tcph = skb_header_pointer(pkt->skb, thoff, sizeof(_tcph), + &_tcph); if (unlikely(!tcph || tcph->fin || tcph->rst || !nf_conntrack_tcp_established(ct))) goto out; -- 2.53.0