Subject: Re: [PATCH nf] netfilter: nft_fwd_netdev: use recursion counter in neigh egress path

From: Weiming Shi <[email-masked]>
Date: Thu, 9 Apr 2026 18:11:53 +0800

On 26-04-09 11:50, Florian Westphal wrote:
> Weiming Shi <[email-masked]> wrote:
> > Fixes: f87b9464d152 ("netfilter: nft_fwd_netdev: Support egress hook")
> > Reported-by: Xiang Mei <[email-masked]>
> > Signed-off-by: Weiming Shi <[email-masked]>
> > ---
> >  include/net/netfilter/nf_dup_netdev.h |  4 ++++
> >  net/netfilter/nf_dup_netdev.c         | 18 ++++++++++++++++++
> >  net/netfilter/nft_fwd_netdev.c        |  7 +++++++
> >  3 files changed, 29 insertions(+)
> > 
> > diff --git a/include/net/netfilter/nf_dup_netdev.h b/include/net/netfilter/nf_dup_netdev.h
> > index b175d271aec9..17362f76d1d1 100644
> > --- a/include/net/netfilter/nf_dup_netdev.h
> > +++ b/include/net/netfilter/nf_dup_netdev.h
> > @@ -7,6 +7,10 @@
> >  void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif);
> >  void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif);
> >  
> > +bool nf_dup_netdev_has_recursed(void);
> > +void nf_dup_netdev_recursion_inc(void);
> > +void nf_dup_netdev_recursion_dec(void);
> > +
> >  struct nft_offload_ctx;
> >  struct nft_flow_rule;
> >  
> > diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
> > index fab8b9011098..e2fe8bb6fe0d 100644
> > --- a/net/netfilter/nf_dup_netdev.c
> > +++ b/net/netfilter/nf_dup_netdev.c
> > @@ -29,6 +29,24 @@ static u8 *nf_get_nf_dup_skb_recursion(void)
> >  
> >  #endif
> >  
> > +bool nf_dup_netdev_has_recursed(void)
> > +{
> > +	return *nf_get_nf_dup_skb_recursion() > NF_RECURSION_LIMIT;
> > +}
> > +EXPORT_SYMBOL_GPL(nf_dup_netdev_has_recursed);
> 
> I think thats a bit too heavy-handed.
> nf_get_nf_dup_skb_recursion() fetches from pcpu counter or current->.
> 
> Can you move nf_get_nf_dup_skb_recursion to a shared header file
> and make it inline instead of having a function call?
> 

Thanks for the review. I will send the patch for version v2 as you suggested.

Weiming Shi