Re: [PATCH nf-next,v2 3/3] netfilter: flowtable: initial bridge support

On Sun, Jul 12, 2026 at 03:46:02PM +0200, Eric Woudstra wrote:
> On 7/12/26 11:27 AM, Eric Woudstra wrote:
> > On 7/10/26 12:07 PM, Pablo Neira Ayuso wrote:
[...]
> After fixing the problems in the patch-set mentioned earlier, when the sotware
> fastpath is setup correctly:

How are you testing this, my series is passing tests with netns and
veths with:

- plain bridge ports.
- VLAN devices used in the ports.

> Setting up a hardware offloaded flow, because the hardware supports it,
> this crashes:
>
> [  283.380108] Unable to handle kernel execute from non-executable memory at virtual address 0000000000000000
> [  283.389925] Mem abort info:
> [  283.393178]   ESR = 0x0000000086000004
> [  283.396940]   EC = 0x21: IABT (current EL), IL = 32 bits
> [  283.402299]   SET = 0, FnV = 0
> [  283.405358]   EA = 0, S1PTW = 0
> [  283.408498]   FSC = 0x04: level 0 translation fault
> [  283.413473] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000419d9000
> [  283.419918] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
> [  283.426766] Internal error: Oops: 0000000086000004 [#1]  SMP
> [  283.432432] Modules linked in: nft_flow_offload nf_flow_table_inet nf_flow_table nft_masq nft_chain_nat nf_nat nf_conntrack_bridge nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables cdc_mbim cdc_wdm cdc_ncm r8153_ecm cdc_ether usbnet r8152 mii mt7915e mt76_connac_lib mt76 mac80211 cfg80211 rfkill libarc4
> [  283.460181] CPU: 1 UID: 0 PID: 2420 Comm: kworker/u16:6 Not tainted 7.2.0-rc1-bpirnn #12 PREEMPT 
> [  283.469040] Hardware name: Bananapi BPI-R3 (DT)
> [  283.473558] Workqueue: nf_ft_offload_add flow_offload_work_handler [nf_flow_table]
> [  283.481128] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> [  283.488084] pc : 0x0
> [  283.490269] lr : nf_flow_offload_rule_alloc+0x45c/0x4b0 [nf_flow_table]
> [  283.496875] sp : ffff8000830b3c90
> [  283.500176] x29: ffff8000830b3c90 x28: ffff00000afc06b8 x27: ffff000007a8a180
> [  283.507298] x26: ffff000006704000 x25: ffff000006704000 x24: ffff0000029598c8
> [  283.514420] x23: ffff00000af7ac50 x22: 0000000000000000 x21: ffff000006704000
> [  283.521541] x20: ffff000002959850 x19: ffff000002959800 x18: 0000000000000000
> [  283.528662] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
> [  283.535785] x14: 0000000000000000 x13: 0000000000000008 x12: 0101010101010101
> [  283.542914] x11: 7f7f7f7f7f7f7f7f x10: fefefefefefeff63 x9 : 0000000000000000
> [  283.550038] x8 : ffff000001f25000 x7 : 0000000000000000 x6 : 000000000000003f
> [  283.557159] x5 : 00000000ffffffff x4 : 0000000000000000 x3 : ffff000002959800
> [  283.564280] x2 : 0000000000000000 x1 : ffff000006704000 x0 : ffff000007a8a180
> [  283.571405] Call trace:
> [  283.573841]  0x0 (P)
> [  283.576022]  flow_offload_work_handler+0x60/0x358 [nf_flow_table]
> [  283.582111]  process_scheduled_works+0x210/0x30c
> [  283.586731]  worker_thread+0x140/0x1d4
> [  283.590478]  kthread+0xf8/0x108
> [  283.593617]  ret_from_fork+0x10/0x20
> 
> Adding .action = nf_flow_rule_bridge, with the function as it is in my latest
> patch named "netfilter: nf_flow_table_offload: Add nf_flow_rule_bridge()",
> it does not crash and the hardware offloaded path functions like a charm.

I still have to reintroduce the _unsupp chunk which it is not included
in the version.