[PATCH nf] netfilter: nft_inner: always save the parsed tunnel context

[Tamaki Yanagawa <ty@000ty.net>]

nft_inner_save_tun_ctx() only updates the per-cpu tunnel context when
its cookie differs from the skb being evaluated. The cookie is the skb
address, so once an skb is freed and its address is reused by the next
packet on that cpu, the context parsed for the new packet is never
stored, and every following inner expression in the chain restores the
offsets and protocols of the previous packet instead. A tunnelled
packet can then be matched against another packet's headers, e.g. a
"vxlan tcp dport 22 drop" rule misses a packet whose inner IP header
length differs from the one before it. Store the context
unconditionally.

Fixes: 7b1d83da254b ("netfilter: nft_inner: incorrect percpu area handling under softirq")
Signed-off-by: Tamaki Yanagawa <ty@000ty.net>
Assisted-by: Claude:claude-opus-5-5
---
 net/netfilter/nft_inner.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c
index 97fb4eea2d..3af5ddd5ff 100644
--- a/net/netfilter/nft_inner.c
+++ b/net/netfilter/nft_inner.c
@@ -265,8 +265,7 @@ static void nft_inner_save_tun_ctx(const struct nft_pktinfo *pkt,
 	local_bh_disable();
 	local_lock_nested_bh(&nft_pcpu_tun_ctx.bh_lock);
 	this_cpu_tun_ctx = this_cpu_ptr(&nft_pcpu_tun_ctx.ctx);
-	if (this_cpu_tun_ctx->cookie != tun_ctx->cookie)
-		*this_cpu_tun_ctx = *tun_ctx;
+	*this_cpu_tun_ctx = *tun_ctx;
 	local_unlock_nested_bh(&nft_pcpu_tun_ctx.bh_lock);
 	local_bh_enable();
 }

base-commit: 734bef548a96e8774d6eef5dfa2026c6edc4e80b
-- 
2.52.0