On Sat, Apr 27, 2019 at 01:54:54AM +0900, Taehee Yoo wrote:
> flow offload of CT can be deleted by the masquerade module. then,
> flow offload should be deleted too. but GC and data-path of flow offload
> do not check CT's status. hence they will be removed only by the timeout.
>
> GC and data-path routine will check ct_general.use value.
> If that value is 1, it means that CT is removed from the list.
> So, GC will delete this and data-path do not use this.
>
> Signed-off-by: Taehee Yoo <ap420073@xxxxxxxxx>
> ---
> net/netfilter/nf_flow_table_core.c | 10 +++++++++-
> 1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
> index 7aabfd4b1e50..334eb561ae48 100644
> --- a/net/netfilter/nf_flow_table_core.c
> +++ b/net/netfilter/nf_flow_table_core.c
> @@ -232,6 +232,7 @@ flow_offload_lookup(struct nf_flowtable *flow_table,
> {
> struct flow_offload_tuple_rhash *tuplehash;
> struct flow_offload *flow;
> + struct flow_offload_entry *e;
> int dir;
>
> tuplehash = rhashtable_lookup(&flow_table->rhashtable, tuple,
> @@ -244,6 +245,10 @@ flow_offload_lookup(struct nf_flowtable *flow_table,
> if (flow->flags & (FLOW_OFFLOAD_DYING | FLOW_OFFLOAD_TEARDOWN))
> return NULL;
>
> + e = container_of(flow, struct flow_offload_entry, flow);
> + if (unlikely(atomic_read(&e->ct->ct_general.use) == 1))
Could we use the IPS_DYING_BIT instead?
