答复: [PATCH] net: Move specific fragmented packet to slow_path instead of dropping it

["Yang Huajian（杨华健）" <huajianyang@asrmicro.com>]

Hi Pablo,

Can you give some advice?

Thanks.

Best Regards,
Huajian

-----邮件原件-----
发件人: Florian Westphal [mailto:fw@strlen.de] 
发送时间: 2025年4月17日 22:12
收件人: Yang Huajian（杨华健） <huajianyang@asrmicro.com>
抄送: pablo@netfilter.org; kadlec@netfilter.org; razor@blackwall.org; idosch@nvidia.com; davem@davemloft.net; dsahern@kernel.org; edumazet@google.com; kuba@kernel.org; pabeni@redhat.com; horms@kernel.org; netfilter-devel@vger.kernel.org; coreteam@netfilter.org; bridge@lists.linux.dev; netdev@vger.kernel.org; linux-kernel@vger.kernel.org
主题: Re: [PATCH] net: Move specific fragmented packet to slow_path instead of dropping it

Huajian Yang <huajianyang@asrmicro.com> wrote:
> The config NF_CONNTRACK_BRIDGE will change the bridge forwarding for 
> fragmented packets.
> 
> The original bridge does not know that it is a fragmented packet and 
> forwards it directly, after NF_CONNTRACK_BRIDGE is enabled, function 
> nf_br_ip_fragment and br_ip6_fragment will check the headroom.
> 
> In original br_forward, insufficient headroom of skb may indeed exist, 
> but there's still a way to save the skb in the device driver after 
> dev_queue_xmit.So droping the skb will change the original bridge 
> forwarding in some cases.

Fixes: 3c171f496ef5 ("netfilter: bridge: add connection tracking system")
Reviewed-by: Florian Westphal <fw@strlen.de>

This should probably be routed via Pablo.

Pablo, feel free to route this via nf-next if you think its not an urgent fix, its been like this since bridge conntrack was added.