mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-05 18:39:59 +00:00
netfilter: nf_flow_table_offload: check the status of dst_neigh
It is better to get the dst_neigh with neigh->lock and check the
nud_state is VALID. If there is not neigh previous, the lookup will
Create a non NUD_VALID with 00:00:00:00:00:00 mac.
Fixes: c29f74e0df
("netfilter: nf_flow_table: hardware offload support")
Signed-off-by: wenxu <wenxu@ucloud.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
parent
1b67e50601
commit
f31ad71c44
1 changed files with 14 additions and 2 deletions
|
@ -170,8 +170,10 @@ static int flow_offload_eth_dst(struct net *net,
|
|||
struct flow_action_entry *entry1 = flow_action_entry_next(flow_rule);
|
||||
const void *daddr = &flow->tuplehash[!dir].tuple.src_v4;
|
||||
const struct dst_entry *dst_cache;
|
||||
unsigned char ha[ETH_ALEN];
|
||||
struct neighbour *n;
|
||||
u32 mask, val;
|
||||
u8 nud_state;
|
||||
u16 val16;
|
||||
|
||||
dst_cache = flow->tuplehash[dir].tuple.dst_cache;
|
||||
|
@ -179,13 +181,23 @@ static int flow_offload_eth_dst(struct net *net,
|
|||
if (!n)
|
||||
return -ENOENT;
|
||||
|
||||
read_lock_bh(&n->lock);
|
||||
nud_state = n->nud_state;
|
||||
ether_addr_copy(ha, n->ha);
|
||||
read_unlock_bh(&n->lock);
|
||||
|
||||
if (!(nud_state & NUD_VALID)) {
|
||||
neigh_release(n);
|
||||
return -ENOENT;
|
||||
}
|
||||
|
||||
mask = ~0xffffffff;
|
||||
memcpy(&val, n->ha, 4);
|
||||
memcpy(&val, ha, 4);
|
||||
flow_offload_mangle(entry0, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 0,
|
||||
&val, &mask);
|
||||
|
||||
mask = ~0x0000ffff;
|
||||
memcpy(&val16, n->ha + 4, 2);
|
||||
memcpy(&val16, ha + 4, 2);
|
||||
val = val16;
|
||||
flow_offload_mangle(entry1, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 4,
|
||||
&val, &mask);
|
||||
|
|
Loading…
Reference in a new issue