[PATCH nf,v3 3/4] netfilter: flowtable: serialize IPS_OFFLOAD bit clearing

Clear the IPS_OFFLOAD bit iif the teardown bit is unset to address a
race between GC, the netdevice event handler (which also results in a
lockless flowtable iteration to set on the teardown bit) and the
datapath (which can teardown the flow too). Otherwise, it is possible to
clear the offload bit of a different ct object that is recycling the
same memory area due to typesafe rcu semantics.

After this patch, the flow_offload_teardown() function is turned into
noop if the teardown bit has been already set on.

Fixes: d2d31ea8cd80 ("netfilter: conntrack: fix erronous removal of offload bit")
Signed-off-by: Pablo Neira Ayuso <[email protected]>
---
v3: new in this series

 net/netfilter/nf_flow_table_core.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
index 675d470ea581..8c84f02c4dd3 100644
--- a/net/netfilter/nf_flow_table_core.c
+++ b/net/netfilter/nf_flow_table_core.c
@@ -394,9 +394,10 @@ static void flow_offload_del(struct nf_flowtable *flow_table,
 
 void flow_offload_teardown(struct flow_offload *flow)
 {
-	clear_bit(IPS_OFFLOAD_BIT, &flow->ct->status);
-	if (!test_and_set_bit(NF_FLOW_TEARDOWN, &flow->flags))
+	if (!test_and_set_bit(NF_FLOW_TEARDOWN, &flow->flags)) {
+		clear_bit(IPS_OFFLOAD_BIT, &flow->ct->status);
 		flow_offload_fixup_ct(flow);
+	}
 }
 EXPORT_SYMBOL_GPL(flow_offload_teardown);
 
-- 
2.47.3