This patch set fixes several bugs in the flowtable modules. First patch fixes netdev refcnt leak bug. The flow offload routine allocates a dst_entry and that has 1 refcnt. So the dst_release() should be called. This patch just adds missing dst_release() in the end of nft_flow_offload_eval(). Second patch adds ttl value check routine. Flow offload data-path routine decreases ttl value. but it doesn't check ttl value. This patch just adds ttl value check routine. If ttl value is under 1, the packet will be passed up to the L3. Third patch adds CT condition check routine into flow offload routines. a flow offloaded CT can be deleted by masquerade notifier. if so, the flow offload shouldn't be used in flow offload data-path and the GC should delete that. v1 -> v2 : - Drop Second patch. - use IPS_DYING_BIT instead of ct refcnt at Third patch. Taehee Yoo (3): netfilter: nf_flow_table: fix netdev refcnt leak netfilter: nf_flow_table: check ttl value in flow offload data path netfilter: nf_flow_table: do not use deleted CT's flow offload net/netfilter/nf_flow_table_core.c | 10 +++++++++- net/netfilter/nf_flow_table_ip.c | 6 ++++++ net/netfilter/nft_flow_offload.c | 1 + 3 files changed, 16 insertions(+), 1 deletion(-) -- 2.17.1
