Patch "net: sched: do not offload flows with a helper in act_ct" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: sched: do not offload flows with a helper in act_ct

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-sched-do-not-offload-flows-with-a-helper-in-act_.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 807ed4d683d48daadffb39d019490e2be6f85cb3
Author: Xin Long <lucien.xin@xxxxxxxxx>
Date:   Mon Nov 13 12:53:28 2023 -0500

    net: sched: do not offload flows with a helper in act_ct
    
    [ Upstream commit 7cd5af0e937a197295f3aa3721031f0fbae49cff ]
    
    There is no hardware supporting ct helper offload. However, prior to this
    patch, a flower filter with a helper in the ct action can be successfully
    set into the HW, for example (eth1 is a bnxt NIC):
    
      # tc qdisc add dev eth1 ingress_block 22 ingress
      # tc filter add block 22 proto ip flower skip_sw ip_proto tcp \
        dst_port 21 ct_state -trk action ct helper ipv4-tcp-ftp
      # tc filter show dev eth1 ingress
    
        filter block 22 protocol ip pref 49152 flower chain 0 handle 0x1
          eth_type ipv4
          ip_proto tcp
          dst_port 21
          ct_state -trk
          skip_sw
          in_hw in_hw_count 1   <----
            action order 1: ct zone 0 helper ipv4-tcp-ftp pipe
             index 2 ref 1 bind 1
            used_hw_stats delayed
    
    This might cause the flower filter not to work as expected in the HW.
    
    This patch avoids this problem by simply returning -EOPNOTSUPP in
    tcf_ct_offload_act_setup() to not allow to offload flows with a helper
    in act_ct.
    
    Fixes: a21b06e73191 ("net: sched: add helper support in act_ct")
    Signed-off-by: Xin Long <lucien.xin@xxxxxxxxx>
    Reviewed-by: Jamal Hadi Salim <jhs@xxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/f8685ec7702c4a448a1371a8b34b43217b583b9d.1699898008.git.lucien.xin@xxxxxxxxx
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/include/net/tc_act/tc_ct.h b/include/net/tc_act/tc_ct.h
index b24ea2d9400ba..1dc2f827d0bcf 100644
--- a/include/net/tc_act/tc_ct.h
+++ b/include/net/tc_act/tc_ct.h
@@ -57,6 +57,11 @@ static inline struct nf_flowtable *tcf_ct_ft(const struct tc_action *a)
 	return to_ct_params(a)->nf_ft;
 }
 
+static inline struct nf_conntrack_helper *tcf_ct_helper(const struct tc_action *a)
+{
+	return to_ct_params(a)->helper;
+}
+
 #else
 static inline uint16_t tcf_ct_zone(const struct tc_action *a) { return 0; }
 static inline int tcf_ct_action(const struct tc_action *a) { return 0; }
@@ -64,6 +69,10 @@ static inline struct nf_flowtable *tcf_ct_ft(const struct tc_action *a)
 {
 	return NULL;
 }
+static inline struct nf_conntrack_helper *tcf_ct_helper(const struct tc_action *a)
+{
+	return NULL;
+}
 #endif /* CONFIG_NF_CONNTRACK */
 
 #if IS_ENABLED(CONFIG_NET_ACT_CT)
diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
index 3922d825ef2d8..6dcc4585576e8 100644
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -1535,6 +1535,9 @@ static int tcf_ct_offload_act_setup(struct tc_action *act, void *entry_data,
 	if (bind) {
 		struct flow_action_entry *entry = entry_data;
 
+		if (tcf_ct_helper(act))
+			return -EOPNOTSUPP;
+
 		entry->id = FLOW_ACTION_CT;
 		entry->ct.action = tcf_ct_action(act);
 		entry->ct.zone = tcf_ct_zone(act);