Hi, On Tue, Jul 07, 2026 at 11:10:43AM +0200, Eric Woudstra wrote: > In case of flow through bridge, when evaluating traffic with double vlan, > pppoe and pppoe-in-q. In this case thoff will be valid only when meta has > been processed. If meta was not processed in nftables, thoff is zero. > > Signed-off-by: Eric Woudstra <[email protected]> > --- > net/netfilter/nft_flow_offload.c | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) > > diff --git a/net/netfilter/nft_flow_offload.c > b/net/netfilter/nft_flow_offload.c > index f8c7f9f631e48..4f68fb64f1657 100644 > --- a/net/netfilter/nft_flow_offload.c > +++ b/net/netfilter/nft_flow_offload.c > @@ -59,7 +59,7 @@ static void nft_flow_offload_eval(const struct nft_expr > *expr, > struct flow_offload *flow; > enum ip_conntrack_dir dir; > struct nf_conn *ct; > - int ret; > + int ret, thoff; > > if (nft_flow_offload_skip(pkt->skb, nft_pf(pkt))) > goto out; > @@ -70,8 +70,11 @@ static void nft_flow_offload_eval(const struct nft_expr > *expr, > > switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) { > case IPPROTO_TCP: > - tcph = skb_header_pointer(pkt->skb, nft_thoff(pkt), > - sizeof(_tcph), &_tcph); > + thoff = nft_thoff(pkt); > + if (thoff == 0) > + goto out;
I addressed this by checking pkt->flags. I promised a helper to Florian to improve readability here, but I still have to come back with such patch. Basically, my assumption is that pkt->flags is unset if no IP packet has been parsed. > + tcph = skb_header_pointer(pkt->skb, thoff, sizeof(_tcph), > + &_tcph); > if (unlikely(!tcph || tcph->fin || tcph->rst || > !nf_conntrack_tcp_established(ct))) > goto out; > -- > 2.53.0 >
