* [PATCH pve-kernel] fix #8217: cherry-pick fix for flowtable vlan packets being untagged
@ 2026-10-27 14:23 Hannes Laimer
0 siblings, 0 replies; only message in thread
From: Hannes Laimer @ 2026-10-27 14:23 UTC (permalink / raw)
To: pve-devel
The problem was that after the walk to construct the flowtable entry
it was possible that only part of the constructed entry was copied
into the table. Namely when the egress device the walk discovered in
its chain was not in the set of devices for the flowtable. That
resulted in the entry construction failing half way through, but the
egress being set. That led to a flowtable entry for a vlan device that
had its egress set, but missed the step to set the tag in its entry.
With this fix an entry that failed part of its construction is not
added.
Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
...ble-bail-out-if-forward-path-cannot-.patch | 189 ++++++++++++++++++
1 file changed, 189 insertions(+)
create mode 100644 patches/kernel/0078-netfilter-flowtable-bail-out-if-forward-path-cannot-.patch
diff --git a/patches/kernel/0078-netfilter-flowtable-bail-out-if-forward-path-cannot-.patch b/patches/kernel/0078-netfilter-flowtable-bail-out-if-forward-path-cannot-.patch
new file mode 100644
index 000000000000..536b82381a06
--- /dev/null
+++ b/patches/kernel/0078-netfilter-flowtable-bail-out-if-forward-path-cannot-.patch
@@ -0,0 +1,189 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Tue, 9 Jun 2026 01:36:48 +0200
+Subject: [PATCH] netfilter: flowtable: bail out if forward path cannot be
+ discovered
+
+If forward path discovery fails for any reason or netdevice is not
+registered for this flowtable, then bail out to classic forwarding path
+rather than providing incomplete forwarding path.
+
+Update the existing forward path parser functions to report an error
+so the flow_offload expressions gives up on setting up the flowtable
+entry.
+
+Link: https://sashiko.dev/#/patchset/20260607094954.48892-15-pablo%40netfilter.org?part=14
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+(cherry picked from commit 871df5007edaacaf2eac58a2871af6044a444ad4)
+[HL: drop needs_gso_segment line that does not exist in the base]
+Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
+---
+ net/netfilter/nf_flow_table_path.c | 81 +++++++++++++++++-------------
+ 1 file changed, 46 insertions(+), 35 deletions(-)
+
+diff --git a/net/netfilter/nf_flow_table_path.c b/net/netfilter/nf_flow_table_path.c
+index 382206e8720c..409c0ea5a49e 100644
+--- a/net/netfilter/nf_flow_table_path.c
++++ b/net/netfilter/nf_flow_table_path.c
+@@ -96,9 +96,9 @@ struct nft_forward_info {
+ enum flow_offload_xmit_type xmit_type;
+ };
+
+-static void nft_dev_path_info(const struct net_device_path_stack *stack,
+- struct nft_forward_info *info,
+- unsigned char *ha, struct nf_flowtable *flowtable)
++static int nft_dev_path_info(const struct net_device_path_stack *stack,
++ struct nft_forward_info *info,
++ unsigned char *ha, struct nf_flowtable *flowtable)
+ {
+ const struct net_device_path *path;
+ int i;
+@@ -126,19 +126,17 @@ static void nft_dev_path_info(const struct net_device_path_stack *stack,
+
+ /* DEV_PATH_VLAN, DEV_PATH_PPPOE and DEV_PATH_TUN */
+ if (path->type == DEV_PATH_TUN) {
+- if (info->num_tuns) {
+- info->indev = NULL;
+- break;
+- }
++ if (info->num_tuns)
++ return -1;
++
+ info->tun.src_v6 = path->tun.src_v6;
+ info->tun.dst_v6 = path->tun.dst_v6;
+ info->tun.l3_proto = path->tun.l3_proto;
+ info->num_tuns++;
+ } else {
+- if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX) {
+- info->indev = NULL;
+- break;
+- }
++ if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX)
++ return -1;
++
+ info->encap[info->num_encaps].id =
+ path->encap.id;
+ info->encap[info->num_encaps].proto =
+@@ -154,22 +152,23 @@ static void nft_dev_path_info(const struct net_device_path_stack *stack,
+
+ switch (path->bridge.vlan_mode) {
+ case DEV_PATH_BR_VLAN_UNTAG_HW:
++ if (info->num_encaps == 0)
++ return -1;
++
+ info->ingress_vlans |= BIT(info->num_encaps - 1);
+ break;
+ case DEV_PATH_BR_VLAN_TAG:
+- if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX) {
+- info->indev = NULL;
+- break;
+- }
++ if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX)
++ return -1;
++
+ info->encap[info->num_encaps].id = path->bridge.vlan_id;
+ info->encap[info->num_encaps].proto = path->bridge.vlan_proto;
+ info->num_encaps++;
+ break;
+ case DEV_PATH_BR_VLAN_UNTAG:
+- if (info->num_encaps == 0) {
+- info->indev = NULL;
+- break;
+- }
++ if (info->num_encaps == 0)
++ return -1;
++
+ info->num_encaps--;
+ break;
+ case DEV_PATH_BR_VLAN_KEEP:
+@@ -178,8 +177,7 @@ static void nft_dev_path_info(const struct net_device_path_stack *stack,
+ info->xmit_type = FLOW_OFFLOAD_XMIT_DIRECT;
+ break;
+ default:
+- info->indev = NULL;
+- break;
++ return -1;
+ }
+ }
+ info->outdev = info->indev;
+@@ -187,6 +185,8 @@ static void nft_dev_path_info(const struct net_device_path_stack *stack,
+ if (nf_flowtable_hw_offload(flowtable) &&
+ nft_is_valid_ether_device(info->indev))
+ info->xmit_type = FLOW_OFFLOAD_XMIT_DIRECT;
++
++ return 0;
+ }
+
+ static bool nft_flowtable_find_dev(const struct net_device *dev,
+@@ -244,11 +244,11 @@ static int nft_flow_tunnel_update_route(const struct nft_pktinfo *pkt,
+ return 0;
+ }
+
+-static void nft_dev_forward_path(const struct nft_pktinfo *pkt,
+- struct nf_flow_route *route,
+- const struct nf_conn *ct,
+- enum ip_conntrack_dir dir,
+- struct nft_flowtable *ft)
++static int nft_dev_forward_path(const struct nft_pktinfo *pkt,
++ struct nf_flow_route *route,
++ const struct nf_conn *ct,
++ enum ip_conntrack_dir dir,
++ struct nft_flowtable *ft)
+ {
+ const struct dst_entry *dst = route->tuple[dir].dst;
+ struct net_device_path_stack stack;
+@@ -256,15 +256,16 @@ static void nft_dev_forward_path(const struct nft_pktinfo *pkt,
+ unsigned char ha[ETH_ALEN];
+ int i;
+
+- if (nft_dev_fill_forward_path(route, dst, ct, dir, ha, &stack) >= 0)
+- nft_dev_path_info(&stack, &info, ha, &ft->data);
++ if (nft_dev_fill_forward_path(route, dst, ct, dir, ha, &stack) < 0 ||
++ nft_dev_path_info(&stack, &info, ha, &ft->data) < 0)
++ return -ENOENT;
++
++ if (!nft_flowtable_find_dev(info.indev, ft))
++ return -ENOENT;
+
+ if (info.outdev)
+ route->tuple[dir].out.ifindex = info.outdev->ifindex;
+
+- if (!info.indev || !nft_flowtable_find_dev(info.indev, ft))
+- return;
+-
+ route->tuple[!dir].in.ifindex = info.indev->ifindex;
+ for (i = 0; i < info.num_encaps; i++) {
+ route->tuple[!dir].in.encap[i].id = info.encap[i].id;
+@@ -287,6 +288,8 @@ static void nft_dev_forward_path(const struct nft_pktinfo *pkt,
+ memcpy(route->tuple[dir].out.h_dest, info.h_dest, ETH_ALEN);
+ route->tuple[dir].xmit_type = info.xmit_type;
+ }
++
++ return 0;
+ }
+
+ int nft_flow_route(const struct nft_pktinfo *pkt, const struct nf_conn *ct,
+@@ -331,11 +334,19 @@ int nft_flow_route(const struct nft_pktinfo *pkt, const struct nf_conn *ct,
+ nft_default_forward_path(route, this_dst, dir);
+ nft_default_forward_path(route, other_dst, !dir);
+
+- if (route->tuple[dir].xmit_type == FLOW_OFFLOAD_XMIT_NEIGH)
+- nft_dev_forward_path(pkt, route, ct, dir, ft);
+- if (route->tuple[!dir].xmit_type == FLOW_OFFLOAD_XMIT_NEIGH)
+- nft_dev_forward_path(pkt, route, ct, !dir, ft);
++ if (route->tuple[dir].xmit_type == FLOW_OFFLOAD_XMIT_NEIGH &&
++ nft_dev_forward_path(pkt, route, ct, dir, ft) < 0)
++ goto err_dst_release;
++
++ if (route->tuple[!dir].xmit_type == FLOW_OFFLOAD_XMIT_NEIGH &&
++ nft_dev_forward_path(pkt, route, ct, !dir, ft) < 0)
++ goto err_dst_release;
+
+ return 0;
++
++err_dst_release:
++ dst_release(route->tuple[dir].dst);
++ dst_release(route->tuple[!dir].dst);
++ return -ENOENT;
+ }
+ EXPORT_SYMBOL_GPL(nft_flow_route);
--
2.47.3
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-10-27 14:23 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-27 14:23 [PATCH pve-kernel] fix #8217: cherry-pick fix for flowtable vlan packets being untagged Hannes Laimer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox