Re: [PATCH v12 nf-next 5/7] netfilter: nft_flow_offload: nft_flow_offload_eval: check thoff==0

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

On Tue, Jul 07, 2026 at 11:10:43AM +0200, Eric Woudstra wrote:
> In case of flow through bridge, when evaluating traffic with double vlan,
> pppoe and pppoe-in-q. In this case thoff will be valid only when meta has
> been processed. If meta was not processed in nftables, thoff is zero.
> 
> Signed-off-by: Eric Woudstra <ericwouds@gmail.com>
> ---
>  net/netfilter/nft_flow_offload.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
> index f8c7f9f631e48..4f68fb64f1657 100644
> --- a/net/netfilter/nft_flow_offload.c
> +++ b/net/netfilter/nft_flow_offload.c
> @@ -59,7 +59,7 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
>  	struct flow_offload *flow;
>  	enum ip_conntrack_dir dir;
>  	struct nf_conn *ct;
> -	int ret;
> +	int ret, thoff;
>  
>  	if (nft_flow_offload_skip(pkt->skb, nft_pf(pkt)))
>  		goto out;
> @@ -70,8 +70,11 @@ static void nft_flow_offload_eval(const struct nft_expr *expr,
>  
>  	switch (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum) {
>  	case IPPROTO_TCP:
> -		tcph = skb_header_pointer(pkt->skb, nft_thoff(pkt),
> -					  sizeof(_tcph), &_tcph);
> +		thoff = nft_thoff(pkt);
> +		if (thoff == 0)
> +			goto out;

I addressed this by checking pkt->flags. I promised a helper to
Florian to improve readability here, but I still have to come back
with such patch. Basically, my assumption is that pkt->flags is unset
if no IP packet has been parsed.

> +		tcph = skb_header_pointer(pkt->skb, thoff, sizeof(_tcph),
> +					  &_tcph);
>  		if (unlikely(!tcph || tcph->fin || tcph->rst ||
>  			     !nf_conntrack_tcp_established(ct)))
>  			goto out;
> -- 
> 2.53.0
>