From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH 3/6] netfilter: nfnetlink_queue: do not free skb on error
Date: Wed, 12 Jan 2011 20:01:58 +0100 [thread overview]
Message-ID: <4D2DFAA6.7070401@netfilter.org> (raw)
In-Reply-To: <1293407904-31464-4-git-send-email-fw@strlen.de>
On 27/12/10 00:58, Florian Westphal wrote:
> Move free responsibility from nf_queue to caller.
> This enables more flexible error handling; we could
> now accept the skb instead of freeing it.
>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
> net/netfilter/core.c | 5 ++++-
> net/netfilter/nf_queue.c | 10 +++++++---
> 2 files changed, 11 insertions(+), 4 deletions(-)
>
> diff --git a/net/netfilter/core.c b/net/netfilter/core.c
> index 518a2e3..73e44c4 100644
> --- a/net/netfilter/core.c
> +++ b/net/netfilter/core.c
> @@ -179,8 +179,11 @@ next_hook:
> if (ret == 0)
> ret = -EPERM;
> } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
> - nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
> + ret = nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
> verdict >> NF_VERDICT_BITS);
> + if (ret < 0)
> + kfree_skb(skb);
> + ret = 0;
> }
Suggestion: Better put this patch on top of the pile. In the previous,
you remove the return value of nf_queue, and again you reintroduce it.
> rcu_read_unlock();
> return ret;
> diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
> index a417458..2a9b80c 100644
> --- a/net/netfilter/nf_queue.c
> +++ b/net/netfilter/nf_queue.c
> @@ -185,7 +185,6 @@ static int __nf_queue(struct sk_buff *skb,
> err_unlock:
> rcu_read_unlock();
> err:
> - kfree_skb(skb);
> kfree(entry);
> return error;
> }
> @@ -216,7 +215,6 @@ int nf_queue(struct sk_buff *skb,
> }
>
> segs = skb_gso_segment(skb, 0);
> - kfree_skb(skb);
> if (IS_ERR(segs))
> return -ENOMEM;
>
> @@ -235,8 +233,12 @@ int nf_queue(struct sk_buff *skb,
> segs = nskb;
> } while (segs);
>
> + /* also free orig skb if only some segments were queued */
> if (unlikely(error && queued))
> error = 0;
> +
> + if (error == 0)
> + kfree_skb(skb);
> return error;
> }
>
> @@ -279,9 +281,11 @@ void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict)
> local_bh_enable();
> break;
> case NF_QUEUE:
> - __nf_queue(skb, elem, entry->pf, entry->hook,
> + err = __nf_queue(skb, elem, entry->pf, entry->hook,
> entry->indev, entry->outdev, entry->okfn,
> verdict >> NF_VERDICT_BITS);
> + if (err < 0)
> + kfree_skb(skb);
> break;
> case NF_STOLEN:
> default:
next prev parent reply other threads:[~2011-01-12 19:02 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-12-26 23:58 [PATCH] NFQUEUE v2 target with 'queue bypass' support Florian Westphal
2010-12-26 23:58 ` [PATCH 1/6] netfilter: kconfig: NFQUEUE is useless without NETFILTER_NETLINK_QUEUE Florian Westphal
2010-12-27 8:41 ` Jan Engelhardt
2010-12-27 8:47 ` Michał Mirosław
2010-12-26 23:58 ` [PATCH 2/6] netfilter: nfnetlink_queue: return error number to caller Florian Westphal
2011-01-12 18:56 ` Pablo Neira Ayuso
2011-01-12 20:49 ` Florian Westphal
2011-01-12 21:59 ` Pablo Neira Ayuso
2011-01-13 0:14 ` Florian Westphal
2010-12-26 23:58 ` [PATCH 3/6] netfilter: nfnetlink_queue: do not free skb on error Florian Westphal
2011-01-12 19:01 ` Pablo Neira Ayuso [this message]
2011-01-12 20:50 ` Florian Westphal
2010-12-26 23:58 ` [PATCH 4/6] netfilter: reduce NF_VERDICT_MASK to 0xff Florian Westphal
2011-01-12 19:02 ` Pablo Neira Ayuso
2011-01-12 20:52 ` Florian Westphal
2011-01-14 14:05 ` Patrick McHardy
2011-01-15 14:29 ` Pablo Neira Ayuso
2011-01-15 14:33 ` Patrick McHardy
2010-12-26 23:58 ` [PATCH 5/6] netfilter: allow NFQUEUE bypass if no listener is available Florian Westphal
2011-01-12 19:03 ` Pablo Neira Ayuso
2010-12-26 23:58 ` [PATCH 6/6] netfilter: do not omit re-route check on NF_QUEUE verdict Florian Westphal
-- strict thread matches above, loose matches on Subject: below --
2011-01-16 13:19 [PATCH v2] NFQUEUE v2 target with 'queue bypass' support Florian Westphal
2011-01-16 13:19 ` [PATCH 3/6] netfilter: nfnetlink_queue: do not free skb on error Florian Westphal
2011-01-18 14:29 ` Patrick McHardy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4D2DFAA6.7070401@netfilter.org \
--to=pablo@netfilter.org \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).