Re: [PATCH nf v4 1/1] bridge: br_netfilter: pin bridge device while NFQUEUE holds fake dst

[Florian Westphal <fw@strlen.de>]

Ren Wei <n05ec@lzu.edu.cn> wrote:
>  #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
>  	const struct sk_buff *skb = entry->skb;
> +	struct dst_entry *dst = skb_dst(skb);
> +	struct net_device *dev = NULL;
>  
>  	if (nf_bridge_info_exists(skb)) {
>  		entry->physin = nf_bridge_get_physindev(skb, entry->state.net);
> @@ -92,6 +95,17 @@ static void __nf_queue_entry_init_physdevs(struct nf_queue_entry *entry)
>  		entry->physin = NULL;
>  		entry->physout = NULL;
>  	}
> +
> +	if (entry->state.pf == NFPROTO_BRIDGE &&
> +	    nf_bridge_info_exists(skb) &&

Is this check redundant?

> +	    dst && (dst->flags & DST_FAKE_RTABLE))

... this should be enough.  In which cases can we have
FAKE_RTABLE and !nf_bridge_info_exists() ?

>  #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
> +	dev_hold(entry->bridge_dev);

LGTM, however, in last iteration sashiko complained that dev_cmp() in
nfnetlink_queue.c should gain a bridge_dev->ifindev check so that entries
are reaped in case bridge goes down.

Could you send a v5 that adds this test? Everything else here LGTM.