[PATCH nf 4/4] netfilter: nf_flow_table: do not use deleted CT's flow offload

[Taehee Yoo]

flow offload of CT can be deleted by the masquerade module. then,
flow offload should be deleted too. but GC and data-path of flow offload
do not check CT's status. hence they will be removed only by the timeout.

GC and data-path routine will check ct_general.use value.
If that value is 1, it means that CT is removed from the list.
So, GC will delete this and data-path do not use this.

Signed-off-by: Taehee Yoo <ap420...@gmail.com>
---
 net/netfilter/nf_flow_table_core.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_flow_table_core.c 
b/net/netfilter/nf_flow_table_core.c
index 7aabfd4b1e50..334eb561ae48 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -232,6 +232,7 @@ flow_offload_lookup(struct nf_flowtable *flow_table,
 {
        struct flow_offload_tuple_rhash *tuplehash;
        struct flow_offload *flow;
+       struct flow_offload_entry *e;
        int dir;
 
        tuplehash = rhashtable_lookup(&flow_table->rhashtable, tuple,
@@ -244,6 +245,10 @@ flow_offload_lookup(struct nf_flowtable *flow_table,
        if (flow->flags & (FLOW_OFFLOAD_DYING | FLOW_OFFLOAD_TEARDOWN))
                return NULL;
 
+       e = container_of(flow, struct flow_offload_entry, flow);
+       if (unlikely(atomic_read(&e->ct->ct_general.use) == 1))
+               return NULL;
+
        return tuplehash;
 }
 EXPORT_SYMBOL_GPL(flow_offload_lookup);
@@ -290,9 +295,12 @@ static inline bool nf_flow_has_expired(const struct 
flow_offload *flow)
 static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data)
 {
        struct nf_flowtable *flow_table = data;
+       struct flow_offload_entry *e;
 
+       e = container_of(flow, struct flow_offload_entry, flow);
        if (nf_flow_has_expired(flow) ||
-           (flow->flags & (FLOW_OFFLOAD_DYING | FLOW_OFFLOAD_TEARDOWN)))
+           (flow->flags & (FLOW_OFFLOAD_DYING | FLOW_OFFLOAD_TEARDOWN)) ||
+           (atomic_read(&e->ct->ct_general.use) == 1))
                flow_offload_del(flow_table, flow);
 }
 
-- 
2.17.1