[PATCH net-next v2 0/4] net: ipv4: some drop reason cleanup and improvements

[PATCH net-next v2 0/4] net: ipv4: some drop reason cleanup and improvements

[Antoine Tenart]

Hi,

A few patches that were laying around cleaning up and improving drop
reasons in net/ipv4.

Thanks,
Antoine

Since v1:
- Added patch 3 [David Ahern's suggestion].

Antoine Tenart (4):
  net: ipv4: make udp_v4_early_demux explicitly return drop reason
  net: ipv4: simplify drop reason handling in ip_rcv_finish_core
  net: ipv4: use the right type for drop reasons in ip_rcv_finish_core
  net: ipv4: convert ip_rcv_options to drop reasons

 include/net/udp.h   |  2 +-
 net/ipv4/ip_input.c | 37 ++++++++++++++++++-------------------
 net/ipv4/udp.c      | 12 ++++++------
 3 files changed, 25 insertions(+), 26 deletions(-)

-- 
2.51.0

[PATCH net-next v2 1/4] net: ipv4: make udp_v4_early_demux explicitly return drop reason

[Antoine Tenart]

udp_v4_early_demux already returns drop reasons as it either returns 0
or ip_mc_validate_source, which itself returns drop reasons. Its return
value is also already used as a drop reason itself.

Makes this explicit by making it return drop reasons.

Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Antoine Tenart <atenart@kernel.org>
---
 include/net/udp.h   |  2 +-
 net/ipv4/ip_input.c |  2 +-
 net/ipv4/udp.c      | 12 ++++++------
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/include/net/udp.h b/include/net/udp.h
index 93b159f30e88..c0f579dec091 100644
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -398,7 +398,7 @@ static inline struct sk_buff *skb_recv_udp(struct sock *sk, unsigned int flags,
 	return __skb_recv_udp(sk, flags, &off, err);
 }
 
-int udp_v4_early_demux(struct sk_buff *skb);
+enum skb_drop_reason udp_v4_early_demux(struct sk_buff *skb);
 bool udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst);
 int udp_err(struct sk_buff *, u32);
 int udp_abort(struct sock *sk, int err);
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index a09aca2c8567..8878e865ddf6 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -319,7 +319,7 @@ static bool ip_can_use_hint(const struct sk_buff *skb, const struct iphdr *iph,
 }
 
 int tcp_v4_early_demux(struct sk_buff *skb);
-int udp_v4_early_demux(struct sk_buff *skb);
+enum skb_drop_reason udp_v4_early_demux(struct sk_buff *skb);
 static int ip_rcv_finish_core(struct net *net,
 			      struct sk_buff *skb, struct net_device *dev,
 			      const struct sk_buff *hint)
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index cca41c569f37..a8bd42d428fb 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2807,7 +2807,7 @@ static struct sock *__udp4_lib_demux_lookup(struct net *net,
 	return NULL;
 }
 
-int udp_v4_early_demux(struct sk_buff *skb)
+enum skb_drop_reason udp_v4_early_demux(struct sk_buff *skb)
 {
 	struct net *net = dev_net(skb->dev);
 	struct in_device *in_dev = NULL;
@@ -2821,7 +2821,7 @@ int udp_v4_early_demux(struct sk_buff *skb)
 
 	/* validate the packet */
 	if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct udphdr)))
-		return 0;
+		return SKB_NOT_DROPPED_YET;
 
 	iph = ip_hdr(skb);
 	uh = udp_hdr(skb);
@@ -2830,12 +2830,12 @@ int udp_v4_early_demux(struct sk_buff *skb)
 		in_dev = __in_dev_get_rcu(skb->dev);
 
 		if (!in_dev)
-			return 0;
+			return SKB_NOT_DROPPED_YET;
 
 		ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
 				       iph->protocol);
 		if (!ours)
-			return 0;
+			return SKB_NOT_DROPPED_YET;
 
 		sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
 						   uh->source, iph->saddr,
@@ -2846,7 +2846,7 @@ int udp_v4_early_demux(struct sk_buff *skb)
 	}
 
 	if (!sk)
-		return 0;
+		return SKB_NOT_DROPPED_YET;
 
 	skb->sk = sk;
 	DEBUG_NET_WARN_ON_ONCE(sk_is_refcounted(sk));
@@ -2873,7 +2873,7 @@ int udp_v4_early_demux(struct sk_buff *skb)
 						     ip4h_dscp(iph),
 						     skb->dev, in_dev, &itag);
 	}
-	return 0;
+	return SKB_NOT_DROPPED_YET;
 }
 
 int udp_rcv(struct sk_buff *skb)
-- 
2.51.0

[PATCH net-next v2 2/4] net: ipv4: simplify drop reason handling in ip_rcv_finish_core

[Antoine Tenart]

Instead of setting the drop reason to SKB_DROP_REASON_NOT_SPECIFIED
early and having to reset it each time it is overridden by a function
returned value, just set the drop reason to the expected value before
returning from ip_rcv_finish_core.

Signed-off-by: Antoine Tenart <atenart@kernel.org>
---
 net/ipv4/ip_input.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 8878e865ddf6..93b8286e526a 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -335,7 +335,6 @@ static int ip_rcv_finish_core(struct net *net,
 			goto drop_error;
 	}
 
-	drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
 	if (READ_ONCE(net->ipv4.sysctl_ip_early_demux) &&
 	    !skb_dst(skb) &&
 	    !skb->sk &&
@@ -354,7 +353,6 @@ static int ip_rcv_finish_core(struct net *net,
 				drop_reason = udp_v4_early_demux(skb);
 				if (unlikely(drop_reason))
 					goto drop_error;
-				drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
 
 				/* must reload iph, skb->head might have changed */
 				iph = ip_hdr(skb);
@@ -372,7 +370,6 @@ static int ip_rcv_finish_core(struct net *net,
 						   ip4h_dscp(iph), dev);
 		if (unlikely(drop_reason))
 			goto drop_error;
-		drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
 	} else {
 		struct in_device *in_dev = __in_dev_get_rcu(dev);
 
@@ -391,8 +388,10 @@ static int ip_rcv_finish_core(struct net *net,
 	}
 #endif
 
-	if (iph->ihl > 5 && ip_rcv_options(skb, dev))
+	if (iph->ihl > 5 && ip_rcv_options(skb, dev)) {
+		drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
 		goto drop;
+	}
 
 	rt = skb_rtable(skb);
 	if (rt->rt_type == RTN_MULTICAST) {
-- 
2.51.0

Re: [PATCH net-next v2 2/4] net: ipv4: simplify drop reason handling in ip_rcv_finish_core

[David Ahern]

On 9/18/25 2:31 AM, Antoine Tenart wrote:
> diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
> index 8878e865ddf6..93b8286e526a 100644
> --- a/net/ipv4/ip_input.c
> +++ b/net/ipv4/ip_input.c
> @@ -335,7 +335,6 @@ static int ip_rcv_finish_core(struct net *net,
>  			goto drop_error;
>  	}
>  
> -	drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
>  	if (READ_ONCE(net->ipv4.sysctl_ip_early_demux) &&
>  	    !skb_dst(skb) &&
>  	    !skb->sk &&
> @@ -354,7 +353,6 @@ static int ip_rcv_finish_core(struct net *net,
>  				drop_reason = udp_v4_early_demux(skb);
>  				if (unlikely(drop_reason))
>  					goto drop_error;
> -				drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
>  
>  				/* must reload iph, skb->head might have changed */
>  				iph = ip_hdr(skb);
> @@ -372,7 +370,6 @@ static int ip_rcv_finish_core(struct net *net,
>  						   ip4h_dscp(iph), dev);
>  		if (unlikely(drop_reason))
>  			goto drop_error;
> -		drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
>  	} else {
>  		struct in_device *in_dev = __in_dev_get_rcu(dev);
>  
> @@ -391,8 +388,10 @@ static int ip_rcv_finish_core(struct net *net,
>  	}
>  #endif
>  
> -	if (iph->ihl > 5 && ip_rcv_options(skb, dev))
> +	if (iph->ihl > 5 && ip_rcv_options(skb, dev)) {
> +		drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
>  		goto drop;
> +	}
>  
>  	rt = skb_rtable(skb);
>  	if (rt->rt_type == RTN_MULTICAST) {

I do not see any of the cleanup changes requested on v1.

Re: [PATCH net-next v2 2/4] net: ipv4: simplify drop reason handling in ip_rcv_finish_core

[Antoine Tenart]

On Thu, Sep 18, 2025 at 09:24:01AM -0600, David Ahern wrote:
> On 9/18/25 2:31 AM, Antoine Tenart wrote:
> > diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
> > index 8878e865ddf6..93b8286e526a 100644
> > --- a/net/ipv4/ip_input.c
> > +++ b/net/ipv4/ip_input.c
> > @@ -335,7 +335,6 @@ static int ip_rcv_finish_core(struct net *net,
> >  			goto drop_error;
> >  	}
> >  
> > -	drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
> >  	if (READ_ONCE(net->ipv4.sysctl_ip_early_demux) &&
> >  	    !skb_dst(skb) &&
> >  	    !skb->sk &&
> > @@ -354,7 +353,6 @@ static int ip_rcv_finish_core(struct net *net,
> >  				drop_reason = udp_v4_early_demux(skb);
> >  				if (unlikely(drop_reason))
> >  					goto drop_error;
> > -				drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
> >  
> >  				/* must reload iph, skb->head might have changed */
> >  				iph = ip_hdr(skb);
> > @@ -372,7 +370,6 @@ static int ip_rcv_finish_core(struct net *net,
> >  						   ip4h_dscp(iph), dev);
> >  		if (unlikely(drop_reason))
> >  			goto drop_error;
> > -		drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
> >  	} else {
> >  		struct in_device *in_dev = __in_dev_get_rcu(dev);
> >  
> > @@ -391,8 +388,10 @@ static int ip_rcv_finish_core(struct net *net,
> >  	}
> >  #endif
> >  
> > -	if (iph->ihl > 5 && ip_rcv_options(skb, dev))
> > +	if (iph->ihl > 5 && ip_rcv_options(skb, dev)) {
> > +		drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
> >  		goto drop;
> > +	}
> >  
> >  	rt = skb_rtable(skb);
> >  	if (rt->rt_type == RTN_MULTICAST) {
> 
> I do not see any of the cleanup changes requested on v1.

They're all done in a new patch (3/4) in that series as that seemed more
logical, where I could also add a Suggested-by tag.

Re: [PATCH net-next v2 2/4] net: ipv4: simplify drop reason handling in ip_rcv_finish_core

[David Ahern]

On 9/18/25 2:31 AM, Antoine Tenart wrote:
> Instead of setting the drop reason to SKB_DROP_REASON_NOT_SPECIFIED
> early and having to reset it each time it is overridden by a function
> returned value, just set the drop reason to the expected value before
> returning from ip_rcv_finish_core.
> 
> Signed-off-by: Antoine Tenart <atenart@kernel.org>
> ---
>  net/ipv4/ip_input.c | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>

[PATCH net-next v2 3/4] net: ipv4: use the right type for drop reasons in ip_rcv_finish_core

[Antoine Tenart]

Make drop reasons be `enum skb_drop_reason` instead of `int`. While at
it make the SKB_NOT_DROPPED_YET checks explicit.

Suggested-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Antoine Tenart <atenart@kernel.org>
---
 net/ipv4/ip_input.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 93b8286e526a..229c7e6b7e4c 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -325,13 +325,13 @@ static int ip_rcv_finish_core(struct net *net,
 			      const struct sk_buff *hint)
 {
 	const struct iphdr *iph = ip_hdr(skb);
+	enum skb_drop_reason drop_reason;
 	struct rtable *rt;
-	int drop_reason;
 
 	if (ip_can_use_hint(skb, iph, hint)) {
 		drop_reason = ip_route_use_hint(skb, iph->daddr, iph->saddr,
 						ip4h_dscp(iph), dev, hint);
-		if (unlikely(drop_reason))
+		if (unlikely(drop_reason != SKB_NOT_DROPPED_YET))
 			goto drop_error;
 	}
 
@@ -351,7 +351,7 @@ static int ip_rcv_finish_core(struct net *net,
 		case IPPROTO_UDP:
 			if (READ_ONCE(net->ipv4.sysctl_udp_early_demux)) {
 				drop_reason = udp_v4_early_demux(skb);
-				if (unlikely(drop_reason))
+				if (unlikely(drop_reason != SKB_NOT_DROPPED_YET))
 					goto drop_error;
 
 				/* must reload iph, skb->head might have changed */
@@ -368,7 +368,7 @@ static int ip_rcv_finish_core(struct net *net,
 	if (!skb_valid_dst(skb)) {
 		drop_reason = ip_route_input_noref(skb, iph->daddr, iph->saddr,
 						   ip4h_dscp(iph), dev);
-		if (unlikely(drop_reason))
+		if (unlikely(drop_reason != SKB_NOT_DROPPED_YET))
 			goto drop_error;
 	} else {
 		struct in_device *in_dev = __in_dev_get_rcu(dev);
-- 
2.51.0

Re: [PATCH net-next v2 3/4] net: ipv4: use the right type for drop reasons in ip_rcv_finish_core

[David Ahern]

On 9/18/25 2:31 AM, Antoine Tenart wrote:
> Make drop reasons be `enum skb_drop_reason` instead of `int`. While at
> it make the SKB_NOT_DROPPED_YET checks explicit.
> 
> Suggested-by: David Ahern <dsahern@kernel.org>
> Signed-off-by: Antoine Tenart <atenart@kernel.org>
> ---
>  net/ipv4/ip_input.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>

Re: [PATCH net-next v2 3/4] net: ipv4: use the right type for drop reasons in ip_rcv_finish_core

[Jakub Kicinski]

On Thu, 18 Sep 2025 10:31:16 +0200 Antoine Tenart wrote:
> -		if (unlikely(drop_reason))
> +		if (unlikely(drop_reason != SKB_NOT_DROPPED_YET))

drop_reason of none / "don't drop" is very intentionally 0 so that we
don't have to make silly comparisons of this sort. I'm applying your v1,
sorry for not paying attention earlier.

[PATCH net-next v2 4/4] net: ipv4: convert ip_rcv_options to drop reasons

[Antoine Tenart]

This converts the only path not returning drop reasons in
ip_rcv_finish_core.

Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Antoine Tenart <atenart@kernel.org>
---
 net/ipv4/ip_input.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 229c7e6b7e4c..f95765f315da 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -263,10 +263,11 @@ int ip_local_deliver(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(ip_local_deliver);
 
-static inline bool ip_rcv_options(struct sk_buff *skb, struct net_device *dev)
+static inline enum skb_drop_reason
+ip_rcv_options(struct sk_buff *skb, struct net_device *dev)
 {
-	struct ip_options *opt;
 	const struct iphdr *iph;
+	struct ip_options *opt;
 
 	/* It looks as overkill, because not all
 	   IP options require packet mangling.
@@ -277,7 +278,7 @@ static inline bool ip_rcv_options(struct sk_buff *skb, struct net_device *dev)
 	*/
 	if (skb_cow(skb, skb_headroom(skb))) {
 		__IP_INC_STATS(dev_net(dev), IPSTATS_MIB_INDISCARDS);
-		goto drop;
+		return SKB_DROP_REASON_NOMEM;
 	}
 
 	iph = ip_hdr(skb);
@@ -286,7 +287,7 @@ static inline bool ip_rcv_options(struct sk_buff *skb, struct net_device *dev)
 
 	if (ip_options_compile(dev_net(dev), opt, skb)) {
 		__IP_INC_STATS(dev_net(dev), IPSTATS_MIB_INHDRERRORS);
-		goto drop;
+		return SKB_DROP_REASON_IP_INHDR;
 	}
 
 	if (unlikely(opt->srr)) {
@@ -298,17 +299,15 @@ static inline bool ip_rcv_options(struct sk_buff *skb, struct net_device *dev)
 					net_info_ratelimited("source route option %pI4 -> %pI4\n",
 							     &iph->saddr,
 							     &iph->daddr);
-				goto drop;
+				return SKB_DROP_REASON_NOT_SPECIFIED;
 			}
 		}
 
 		if (ip_options_rcv_srr(skb, dev))
-			goto drop;
+			return SKB_DROP_REASON_NOT_SPECIFIED;
 	}
 
-	return false;
-drop:
-	return true;
+	return SKB_NOT_DROPPED_YET;
 }
 
 static bool ip_can_use_hint(const struct sk_buff *skb, const struct iphdr *iph,
@@ -388,9 +387,10 @@ static int ip_rcv_finish_core(struct net *net,
 	}
 #endif
 
-	if (iph->ihl > 5 && ip_rcv_options(skb, dev)) {
-		drop_reason = SKB_DROP_REASON_NOT_SPECIFIED;
-		goto drop;
+	if (iph->ihl > 5) {
+		drop_reason = ip_rcv_options(skb, dev);
+		if (drop_reason != SKB_NOT_DROPPED_YET)
+			goto drop;
 	}
 
 	rt = skb_rtable(skb);
-- 
2.51.0