Commit 79b9b685 authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: flowtable: fetch stats only if flow is still alive 



Do not fetch statistics if flow has expired since it might not in
hardware anymore. After this update, remove the FLOW_OFFLOAD_HW_DYING
check from nf_flow_offload_stats() since this flag is never set on.

Fixes: c29f74e0 ("netfilter: nf_flow_table: hardware offload support")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Acked-by: default avatarwenxu <wenxu@ucloud.cn>
parent 4a7faaf4

net/netfilter/nf_flow_table_core.c

+2 −3
Original line number Diff line number Diff line
@@ -348,9 +348,6 @@ static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data) 
{

	struct nf_flowtable *flow_table = data;



	if (flow->flags & FLOW_OFFLOAD_HW)

		nf_flow_offload_stats(flow_table, flow);



	if (nf_flow_has_expired(flow) || nf_ct_is_dying(flow->ct) ||

	    (flow->flags & (FLOW_OFFLOAD_DYING | FLOW_OFFLOAD_TEARDOWN))) {

		if (flow->flags & FLOW_OFFLOAD_HW) {
@@ -361,6 +358,8 @@ static void nf_flow_offload_gc_step(struct flow_offload *flow, void *data) 
		} else {

			flow_offload_del(flow_table, flow);

		}

	} else if (flow->flags & FLOW_OFFLOAD_HW) {

		nf_flow_offload_stats(flow_table, flow);

	}

}

net/netfilter/nf_flow_table_offload.c

+1 −2
Original line number Diff line number Diff line
@@ -784,8 +784,7 @@ void nf_flow_offload_stats(struct nf_flowtable *flowtable, 
	__s32 delta;



	delta = nf_flow_timeout_delta(flow->timeout);

	if ((delta >= (9 * NF_FLOW_TIMEOUT) / 10) ||

	    flow->flags & FLOW_OFFLOAD_HW_DYING)

	if ((delta >= (9 * NF_FLOW_TIMEOUT) / 10))

		return;



	offload = kzalloc(sizeof(struct flow_offload_work), GFP_ATOMIC);

CRA Git | Maintained and supported by SUSTech CRA and CCSE