2022-01-24 19:17:36

by Menglong Dong

Subject: [PATCH net-next 1/6] net: netfilter: use kfree_drop_reason() for NF_DROP

From: Menglong Dong <[email protected]>

Replace kfree_skb() with kfree_skb_reason() in nf_hook_slow() when
skb is dropped by reason of NF_DROP.

Signed-off-by: Menglong Dong <[email protected]>
---
include/linux/skbuff.h | 1 +
include/trace/events/skb.h | 1 +
net/netfilter/core.c | 3 ++-
3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index bf11e1fbd69b..1bcd690b8ae1 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -320,6 +320,7 @@ enum skb_drop_reason {
SKB_DROP_REASON_TCP_CSUM,
SKB_DROP_REASON_TCP_FILTER,
SKB_DROP_REASON_UDP_CSUM,
+ SKB_DROP_REASON_NETFILTER_DROP,
SKB_DROP_REASON_MAX,
};

diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h
index 3e042ca2cedb..beed7bb2bc0e 100644
--- a/include/trace/events/skb.h
+++ b/include/trace/events/skb.h
@@ -16,6 +16,7 @@
EM(SKB_DROP_REASON_TCP_CSUM, TCP_CSUM) \
EM(SKB_DROP_REASON_TCP_FILTER, TCP_FILTER) \
EM(SKB_DROP_REASON_UDP_CSUM, UDP_CSUM) \
+ EM(SKB_DROP_REASON_NETFILTER_DROP, NETFILTER_DROP) \
EMe(SKB_DROP_REASON_MAX, MAX)

#undef EM
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 354cb472f386..d1c9dfbb11fa 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -621,7 +621,8 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state,
case NF_ACCEPT:
break;
case NF_DROP:
- kfree_skb(skb);
+ kfree_skb_reason(skb,
+ SKB_DROP_REASON_NETFILTER_DROP);
ret = NF_DROP_GETERR(verdict);
if (ret == 0)
ret = -EPERM;
--
2.34.1

2022-01-26 13:06:10

by Jakub Kicinski

Subject: Re: [PATCH net-next 1/6] net: netfilter: use kfree_drop_reason() for NF_DROP

On Mon, 24 Jan 2022 21:15:33 +0800 [email protected] wrote:
> From: Menglong Dong <[email protected]>
>
> Replace kfree_skb() with kfree_skb_reason() in nf_hook_slow() when
> skb is dropped by reason of NF_DROP.

Netfilter folks, does this look good enough to you?

Do you prefer to take the netfilter changes via your tree? I'm asking
because enum skb_drop_reason is probably going to be pretty hot so if
the patch is simple enough maybe no point dealing with merge conflicts.

2022-01-26 13:46:47

by Pablo Neira Ayuso

Subject: Re: [PATCH net-next 1/6] net: netfilter: use kfree_drop_reason() for NF_DROP

On Tue, Jan 25, 2022 at 03:32:14PM -0800, Jakub Kicinski wrote:
> On Mon, 24 Jan 2022 21:15:33 +0800 [email protected] wrote:
> > From: Menglong Dong <[email protected]>
> >
> > Replace kfree_skb() with kfree_skb_reason() in nf_hook_slow() when
> > skb is dropped by reason of NF_DROP.
>
> Netfilter folks, does this look good enough to you?
>
> Do you prefer to take the netfilter changes via your tree? I'm asking
> because enum skb_drop_reason is probably going to be pretty hot so if
> the patch is simple enough maybe no point dealing with merge conflicts.

I also think it's easier if you take it through net.git.

Thanks for asking.