| Message ID | 1584281705-26228-1-git-send-email-yanhaishuang@cmss.chinamobile.com |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | David Miller |
| Headers | show |
| Series | [1/4] netfilter: nf_flow_table: reload ipv6h in nf_flow_nat_ipv6 | expand |
On Sun, Mar 15, 2020 at 10:15:02PM +0800, Haishuang Yan wrote: > Since nf_flow_snat_port and nf_flow_snat_ipv6 call pskb_may_pull() > which may change skb->data, so we need to reload ipv6h at the right > palce. Could you collapse patch 1/4 and 2/4 ? Same thing with patches 3/4 and 4/4 ? Thanks.
> On 2020年3月16日, at 上午4:44, Pablo Neira Ayuso <pablo@netfilter.org> wrote: > > On Sun, Mar 15, 2020 at 10:15:02PM +0800, Haishuang Yan wrote: >> Since nf_flow_snat_port and nf_flow_snat_ipv6 call pskb_may_pull() >> which may change skb->data, so we need to reload ipv6h at the right >> palce. > > Could you collapse patch 1/4 and 2/4 ? > > Same thing with patches 3/4 and 4/4 ? > > Thanks. > Okay, I will collapse the patches. Thanks.
diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 5272721..2e6ebbe 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -417,11 +417,12 @@ static int nf_flow_nat_ipv6(const struct flow_offload *flow, if (test_bit(NF_FLOW_SNAT, &flow->flags) && (nf_flow_snat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 || - nf_flow_snat_ipv6(flow, skb, ip6h, thoff, dir) < 0)) + nf_flow_snat_ipv6(flow, skb, ipv6_hdr(skb), thoff, dir) < 0)) return -1; + ip6h = ipv6_hdr(skb); if (test_bit(NF_FLOW_DNAT, &flow->flags) && (nf_flow_dnat_port(flow, skb, thoff, ip6h->nexthdr, dir) < 0 || - nf_flow_dnat_ipv6(flow, skb, ip6h, thoff, dir) < 0)) + nf_flow_dnat_ipv6(flow, skb, ipv6_hdr(skb), thoff, dir) < 0)) return -1; return 0;
Since nf_flow_snat_port and nf_flow_snat_ipv6 call pskb_may_pull() which may change skb->data, so we need to reload ipv6h at the right palce. Fixes: a908fdec3dda ("netfilter: nf_flow_table: move ipv6 offload hook code to nf_flow_table") Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com> --- net/netfilter/nf_flow_table_ip.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)