[PATCH nf-next] netfilter: flowtable: do not hw offload flows in teardown state

[PATCH nf-next] netfilter: flowtable: do not hw offload flows in teardown state

[Pablo Neira Ayuso]

Sashiko reports that refreshing hw offload from packet path is racy
since the flow might be already going away. Refresh the flow instead via
GC worker to address this, ie. if hardware offload fails, next GC run
will give this flow a chance to offload it to hardware.

Since commit 7c549fb7eecd ("netfilter: flowtable: generalize pending
status bit"), GC skips flow entries that are still pending to be
offloaded. Let's just check for the teardown status bit after the
pending bit is set on to address this race.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
Another attempt, aiming at a more simple approach to address the race.

 net/netfilter/nf_flow_table_offload.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index 5aed013d6468..0473696ddb1d 100644
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -1101,8 +1101,9 @@ nf_flow_offload_work_alloc(struct nf_flowtable *flowtable,
 		return NULL;
 
 	offload = kmalloc_obj(struct flow_offload_work, GFP_ATOMIC);
-	if (!offload) {
+	if (!offload || test_bit(NF_FLOW_TEARDOWN, &flow->flags)) {
 		clear_bit(NF_FLOW_PENDING, &flow->flags);
+		kfree(offload);
 		return NULL;
 	}
 
-- 
2.47.3

[syzbot ci] Re: netfilter: flowtable: do not hw offload flows in teardown state

[syzbot ci]

syzbot ci has tested the following series

[v1] netfilter: flowtable: do not hw offload flows in teardown state
https://lore.kernel.org/all/20261016085202.1670076-1-pablo@netfilter.org
* [PATCH nf-next] netfilter: flowtable: do not hw offload flows in teardown state

and found the following issue:
WARNING in nf_conntrack_cleanup_net_list

Full report is available here:
https://ci.syzbot.org/series/ea5f346a-b1ba-462a-a812-0b29a292b49e

***

WARNING in nf_conntrack_cleanup_net_list

tree:      nf-next
URL:       https://kernel.googlesource.com/pub/scm/linux/kernel/git/netfilter/nf-next.git
base:      a5e7d8e446af9803e37a3b6a4d416fb41178348f
arch:      amd64
compiler:  Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
config:    https://ci.syzbot.org/builds/90f3437c-11cd-439b-8d1a-bb938b62b48e/config

------------[ cut here ]------------
conntrack cleanup blocked for 60s
WARNING: net/netfilter/nf_conntrack_core.c:2504 at nf_conntrack_cleanup_net_list+0x21f/0x360, CPU#0: kworker/u8:0/12
Modules linked in:
CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: netns cleanup_net
RIP: 0010:nf_conntrack_cleanup_net_list+0x21f/0x360
Code: 4c 89 ef e8 63 bd 37 f8 4d 8b 7d 00 4d 39 ef 74 69 e8 f5 eb c6 f7 45 31 e4 e9 a5 fe ff ff e8 e8 eb c6 f7 48 8d 3d 41 56 88 07 <67> 48 0f b9 3a eb c0 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c da fe ff
RSP: 0018:ffffc900001178b0 EFLAGS: 00010293
RAX: ffffffff8a011228 RBX: dffffc0000000000 RCX: ffff888102eb8000
RDX: 0000000000000000 RSI: ffffffffffffffc9 RDI: ffffffff91896870
RBP: 0000000000000021 R08: ffff888116ce7c03 R09: 1ffff11022d9cf80
R10: dffffc0000000000 R11: ffffed1022d9cf81 R12: 000000010002f152
R13: ffffc90000117a50 R14: ffffc90000117a50 R15: 000000010002f189
FS:  0000000000000000(0000) GS:ffff88818c4d4000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6e7bd28ae0 CR3: 00000000132ca000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 ops_undo_list+0x4b4/0x8d0
 cleanup_net+0x572/0x810
 process_scheduled_works+0xc3d/0x1630
 worker_thread+0xa47/0xfb0
 kthread+0x38b/0x480
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>


***

If these findings have caused you to resend the series or submit a
separate fix, please add the following tag to your commit message:
  Tested-by: syzbot@syzkaller.appspotmail.com

---
This report is generated by a bot. It may contain errors.
syzbot ci engineers can be reached at syzkaller@googlegroups.com.

To test a fix for this bug, please reply with `#syz test`
(on a separate line) and attach the patch to the email.

Notes:
- The patch will be applied on top of the tested series (as an
  incremental fix).
- To test a new version of the whole series, please send it directly
  to syzbot@lists.linux.dev.
- Arguments like custom git repos and branches are not supported.