Re: [PATCH nf] netfilter: nft_fwd_netdev: use recursion counter in neigh egress path

Florian Westphal
2026-04-09T09:50:36Z

Weiming Shi <bestswngs@gmail.com> wrote:
> Fixes: f87b9464d152 ("netfilter: nft_fwd_netdev: Support egress hook")
> Reported-by: Xiang Mei <xmei5@asu.edu>
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> ---
> include/net/netfilter/nf_dup_netdev.h | 4 ++++
> net/netfilter/nf_dup_netdev.c | 18 ++++++++++++++++++
> net/netfilter/nft_fwd_netdev.c | 7 +++++++
> 3 files changed, 29 insertions(+)
>
> diff --git a/include/net/netfilter/nf_dup_netdev.h b/include/net/netfilter/nf_dup_netdev.h
> index b175d271aec9..17362f76d1d1 100644
> --- a/include/net/netfilter/nf_dup_netdev.h
> +++ b/include/net/netfilter/nf_dup_netdev.h
> @@ -7,6 +7,10 @@
> void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif);
> void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif);
>
> +bool nf_dup_netdev_has_recursed(void);
> +void nf_dup_netdev_recursion_inc(void);
> +void nf_dup_netdev_recursion_dec(void);
> +
> struct nft_offload_ctx;
> struct nft_flow_rule;
>
> diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
> index fab8b9011098..e2fe8bb6fe0d 100644
> --- a/net/netfilter/nf_dup_netdev.c
> +++ b/net/netfilter/nf_dup_netdev.c
> @@ -29,6 +29,24 @@ static u8 *nf_get_nf_dup_skb_recursion(void)
>
> #endif
>
> +bool nf_dup_netdev_has_recursed(void)
> +{
> + return *nf_get_nf_dup_skb_recursion() > NF_RECURSION_LIMIT;
> +}
> +EXPORT_SYMBOL_GPL(nf_dup_netdev_has_recursed);

I think thats a bit too heavy-handed.
nf_get_nf_dup_skb_recursion() fetches from pcpu counter or current->.

Can you move nf_get_nf_dup_skb_recursion to a shared header file
and make it inline instead of having a function call?