[PATCH net-next] netfilter: remove two dropwatch false positives

[PATCH net-next] netfilter: remove two dropwatch false positives

[Eric Dumazet]

From: Eric Dumazet <edumazet@google.com>

After skb_copy_expand() call, we want to switch skbs without dropping
original one. Call consume_skb() to avoid drop_monitor sending a drop
event.

Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/ipv4/netfilter/ip_queue.c  |    2 +-
 net/ipv6/netfilter/ip6_queue.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 09775a1..dd88537 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -296,7 +296,7 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
 				      "in mangle, dropping packet\n");
 				return -ENOMEM;
 			}
-			kfree_skb(e->skb);
+			consume_skb(e->skb);
 			e->skb = nskb;
 		}
 		skb_put(e->skb, diff);
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 3ca9303..e1d5465 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -296,7 +296,7 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
 				      "in mangle, dropping packet\n");
 				return -ENOMEM;
 			}
-			kfree_skb(e->skb);
+			consume_skb(e->skb);
 			e->skb = nskb;
 		}
 		skb_put(e->skb, diff);

Re: [PATCH net-next] netfilter: remove two dropwatch false positives

[Pablo Neira Ayuso]

On Wed, May 02, 2012 at 09:13:10AM +0200, Eric Dumazet wrote:
> From: Eric Dumazet <edumazet@google.com>
> 
> After skb_copy_expand() call, we want to switch skbs without dropping
> original one. Call consume_skb() to avoid drop_monitor sending a drop
> event.

We have removed ip_queue in 3.5. That's why I cannot take this patch.

Re: [PATCH net-next] netfilter: remove two dropwatch false positives

[Eric Dumazet]

Le mercredi 09 mai 2012 à 13:36 +0200, Pablo Neira Ayuso a écrit :
> On Wed, May 02, 2012 at 09:13:10AM +0200, Eric Dumazet wrote:
> > From: Eric Dumazet <edumazet@google.com>
> > 
> > After skb_copy_expand() call, we want to switch skbs without dropping
> > original one. Call consume_skb() to avoid drop_monitor sending a drop
> > event.
> 
> We have removed ip_queue in 3.5. That's why I cannot take this patch.

So far, so good !

Thanks


--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html