[PATCH nf-next] netfilter: flowtable: do not hw offload flows in teardown state

[Pablo Neira Ayuso <pablo@netfilter.org>]

Sashiko reports that refreshing hw offload from packet path is racy
since the flow might be already going away. Refresh the flow instead via
GC worker to address this, ie. if hardware offload fails, next GC run
will give this flow a chance to offload it to hardware.

Since commit 7c549fb7eecd ("netfilter: flowtable: generalize pending
status bit"), GC skips flow entries that are still pending to be
offloaded. Let's just check for the teardown status bit after the
pending bit is set on to address this race.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
Another attempt, aiming at a more simple approach to address the race.

 net/netfilter/nf_flow_table_offload.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index 5aed013d6468..0473696ddb1d 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -1101,8 +1101,9 @@ nf_flow_offload_work_alloc(struct nf_flowtable *flowtable,
 		return NULL;
 
 	offload = kmalloc_obj(struct flow_offload_work, GFP_ATOMIC);
-	if (!offload) {
+	if (!offload || test_bit(NF_FLOW_TEARDOWN, &flow->flags)) {
 		clear_bit(NF_FLOW_PENDING, &flow->flags);
+		kfree(offload);
 		return NULL;
 	}
 
-- 
2.47.3