From mboxrd@z Thu Jan  1 00:00:00 1970
From: Pablo Neira Ayuso <pablo@netfilter.org>
Subject: Re: [PATCH net-next 2/2] net: sched: add em_ipt ematch for calling
 xtables matches
Date: Thu, 25 Jan 2018 01:00:07 +0100
Message-ID: <20180125000007.dbg536a7ncstpoqc@salvia>
References: <1516699052-19259-1-git-send-email-eyal.birger@gmail.com>
 <1516699052-19259-3-git-send-email-eyal.birger@gmail.com>
 <20180124.163716.301711852222011274.davem@davemloft.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: eyal.birger@gmail.com, jhs@mojatatu.com, xiyou.wangcong@gmail.com,
        netdev@vger.kernel.org, shmulik@metanetworks.com,
        eyal@metanetworks.com
To: David Miller <davem@davemloft.net>
Return-path: <netdev-owner@vger.kernel.org>
Received: from mail.us.es ([193.147.175.20]:43276 "EHLO mail.us.es"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S932072AbeAYAAM (ORCPT <rfc822;netdev@vger.kernel.org>);
        Wed, 24 Jan 2018 19:00:12 -0500
Received: from antivirus1-rhel7.int (unknown [192.168.2.11])
        by mail.us.es (Postfix) with ESMTP id 750FA1BFA8B
        for <netdev@vger.kernel.org>; Thu, 25 Jan 2018 01:00:11 +0100 (CET)
Received: from antivirus1-rhel7.int (localhost [127.0.0.1])
        by antivirus1-rhel7.int (Postfix) with ESMTP id 63A37BAC31
        for <netdev@vger.kernel.org>; Thu, 25 Jan 2018 01:00:11 +0100 (CET)
Content-Disposition: inline
In-Reply-To: <20180124.163716.301711852222011274.davem@davemloft.net>
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

On Wed, Jan 24, 2018 at 04:37:16PM -0500, David Miller wrote:
> From: Eyal Birger <eyal.birger@gmail.com>
> Date: Tue, 23 Jan 2018 11:17:32 +0200
> 
> > +	network_offset = skb_network_offset(skb);
> > +	skb_pull(skb, network_offset);
> > +
> > +	rcu_read_lock();
> > +
> > +	if (skb->skb_iif)
> > +		indev = dev_get_by_index_rcu(em->net, skb->skb_iif);
> > +
> > +	nf_hook_state_init(&state, im->hook, im->nfproto, indev ?: skb->dev,
> > +			   skb->dev, NULL, em->net, NULL);
> > +
> > +	acpar.match = im->match;
> > +	acpar.matchinfo = im->match_data;
> > +	acpar.state = &state;
> > +
> > +	ret = im->match->match(skb, &acpar);
> > +
> > +	rcu_read_unlock();
> > +
> > +	skb_push(skb, network_offset);
> 
> If the SKB is shared in any way, this pull/push around the NF hook
> invocation is illegal.

At ingress, skb->data points to the network header, which is what the
xtables matches expect, so these are actually noops, therefore,
skb_pull() and skb_push() can be removed.