netfilter: fix crash in flow offload by adding netns support
authorHsiuWen Yen <y.hsiuwen@gmail.com>
Thu, 20 Jun 2019 16:44:42 +0000 (00:44 +0800)
committerRISCi_ATOM <bob@bobcall.me>
Sun, 29 Sep 2019 16:39:43 +0000 (12:39 -0400)
commit405fec9803644ccd346b603febe8dc61d8d56a2d
tree5e5d9086ec6cb58986a2eaa0c5a9a9d61eab82d5
parent73e15ff49b83adf3c95b91058ba17839a52d4683
netfilter: fix crash in flow offload by adding netns support

Commit fcb41decf6c6 ("config: enable some useful features on
!SMALL_FLASH devices") enabled netns, which in turn lead to the crash in
the flow offload target.

When the flow offloading framework intends to delete a flow from the
hardware table, it is necessary to retrieve the namespace from
nf_flowtable->ft_net. However, no one ever wrote the namespace into
nf_flowtable->ft_net in advance. So the framework will mistakenly use a
NULL namespace to execute dev_get_by_index_rcu(net, ifindex), leading to
the kernel panic.

Ref: FS#2321
Fixes: fcb41decf6c6 ("config: enable some useful features on !SMALL_FLASH devices")
Tested-by: Simon Tretter <simon@mediaarchitectu.re>
Signed-off-by: HsiuWen Yen <y.hsiuwen@gmail.com>
[merged patch into offload patch, fix for 4.19, SOB fix, commit subj/msg touches]
Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry-picked from commit d344591e72e5ca96a2bf70a2df38961553185ce8)
target/linux/generic/hack-4.14/650-netfilter-add-xt_OFFLOAD-target.patch