Re: [PATCH nf] netfilter: nft_fwd_netdev: use recursion counter in neigh egress path

Weiming Shi
2026-04-09T10:11:59Z

On 26-04-09 11:50, Florian Westphal wrote:
> Weiming Shi <bestswngs@gmail.com> wrote:
> > Fixes: f87b9464d152 ("netfilter: nft_fwd_netdev: Support egress hook")
> > Reported-by: Xiang Mei <xmei5@asu.edu>
> > Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> > ---
> > include/net/netfilter/nf_dup_netdev.h | 4 ++++
> > net/netfilter/nf_dup_netdev.c | 18 ++++++++++++++++++
> > net/netfilter/nft_fwd_netdev.c | 7 +++++++
> > 3 files changed, 29 insertions(+)
> >
> > diff --git a/include/net/netfilter/nf_dup_netdev.h b/include/net/netfilter/nf_dup_netdev.h
> > index b175d271aec9..17362f76d1d1 100644
> > --- a/include/net/netfilter/nf_dup_netdev.h
> > +++ b/include/net/netfilter/nf_dup_netdev.h
> > @@ -7,6 +7,10 @@
> > void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif);
> > void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif);
> >
> > +bool nf_dup_netdev_has_recursed(void);
> > +void nf_dup_netdev_recursion_inc(void);
> > +void nf_dup_netdev_recursion_dec(void);
> > +
> > struct nft_offload_ctx;
> > struct nft_flow_rule;
> >
> > diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
> > index fab8b9011098..e2fe8bb6fe0d 100644
> > --- a/net/netfilter/nf_dup_netdev.c
> > +++ b/net/netfilter/nf_dup_netdev.c
> > @@ -29,6 +29,24 @@ static u8 *nf_get_nf_dup_skb_recursion(void)
> >
> > #endif
> >
> > +bool nf_dup_netdev_has_recursed(void)
> > +{
> > + return *nf_get_nf_dup_skb_recursion() > NF_RECURSION_LIMIT;
> > +}
> > +EXPORT_SYMBOL_GPL(nf_dup_netdev_has_recursed);
>
> I think thats a bit too heavy-handed.
> nf_get_nf_dup_skb_recursion() fetches from pcpu counter or current->.
>
> Can you move nf_get_nf_dup_skb_recursion to a shared header file
> and make it inline instead of having a function call?
>

Thanks for the review. I will send the patch for version v2 as you suggested.

Weiming Shi