netfilter: nf_flow_table_offload: check the status of dst_neigh

It is better to get the dst_neigh with neigh->lock and check the
nud_state is VALID. If there is not neigh previous, the lookup will
Create a non NUD_VALID with 00:00:00:00:00:00 mac.

Fixes: c550be63df75 ("netfilter: nf_flow_table: hardware offload support")
Signed-off-by: wenxu <wenxu@ucloud.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
index ee9edbe50d4f592c6549c7c5f1c6152cecb67bc0..92b0bd2410731c178d5a3c2d9433f7cdab41f17a 100644 (file)
--- a/net/netfilter/nf_flow_table_offload.c
+++ b/net/netfilter/nf_flow_table_offload.c
@@ -170,8 +170,10 @@ static int flow_offload_eth_dst(struct net *net,
        struct flow_action_entry *entry1 = flow_action_entry_next(flow_rule);
        const void *daddr = &flow->tuplehash[!dir].tuple.src_v4;
        const struct dst_entry *dst_cache;
+       unsigned char ha[ETH_ALEN];
        struct neighbour *n;
        u32 mask, val;
+       u8 nud_state;
        u16 val16;
 
        dst_cache = flow->tuplehash[dir].tuple.dst_cache;
@@ -179,13 +181,23 @@ static int flow_offload_eth_dst(struct net *net,
        if (!n)
                return -ENOENT;
 
+       read_lock_bh(&n->lock);
+       nud_state = n->nud_state;
+       ether_addr_copy(ha, n->ha);
+       read_unlock_bh(&n->lock);
+
+       if (!(nud_state & NUD_VALID)) {
+               neigh_release(n);
+               return -ENOENT;
+       }
+
        mask = ~0xffffffff;
-       memcpy(&val, n->ha, 4);
+       memcpy(&val, ha, 4);
        flow_offload_mangle(entry0, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 0,
                            &val, &mask);
 
        mask = ~0x0000ffff;
-       memcpy(&val16, n->ha + 4, 2);
+       memcpy(&val16, ha + 4, 2);
        val = val16;
        flow_offload_mangle(entry1, FLOW_ACT_MANGLE_HDR_TYPE_ETH, 4,
                            &val, &mask);