Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.1/patches/2229261/?format=api
{ "id": 2229261, "url": "http://patchwork.ozlabs.org/api/1.1/patches/2229261/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260427224929.29868-2-pablo@netfilter.org/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/1.1/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null }, "msgid": "<20260427224929.29868-2-pablo@netfilter.org>", "date": "2026-04-27T22:49:28", "name": "[nf,v7,2/3] netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "15662778f5ea90d1a1a464f62c4d0a6f9adc8b3a", "submitter": { "id": 1315, "url": "http://patchwork.ozlabs.org/api/1.1/people/1315/?format=api", "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260427224929.29868-2-pablo@netfilter.org/mbox/", "series": [ { "id": 501740, "url": "http://patchwork.ozlabs.org/api/1.1/series/501740/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=501740", "date": "2026-04-27T22:49:29", "name": "[nf,v7,1/3] netfilter: replace skb_try_make_writable() by skb_ensure_writable()", "version": 7, "mbox": "http://patchwork.ozlabs.org/series/501740/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2229261/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2229261/checks/", "tags": {}, "headers": { "Return-Path": "\n <netfilter-devel+bounces-12232-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=netfilter.org header.i=@netfilter.org\n header.a=rsa-sha256 header.s=2025 header.b=kjBr7p5y;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-12232-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=\"kjBr7p5y\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=217.70.190.124", "smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=netfilter.org" ], "Received": [ "from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g4Jff2SPrz1xvV\n\tfor <incoming@patchwork.ozlabs.org>; Tue, 28 Apr 2026 08:49:46 +1000 (AEST)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 42CDA3044131\n\tfor <incoming@patchwork.ozlabs.org>; Mon, 27 Apr 2026 22:49:38 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 7D5743AE183;\n\tMon, 27 Apr 2026 22:49:37 +0000 (UTC)", "from mail.netfilter.org (mail.netfilter.org [217.70.190.124])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 8D37623505E\n\tfor <netfilter-devel@vger.kernel.org>; Mon, 27 Apr 2026 22:49:35 +0000 (UTC)", "from localhost.localdomain (mail-agni [217.70.190.124])\n\tby mail.netfilter.org (Postfix) with ESMTPSA id D610F6024E\n\tfor <netfilter-devel@vger.kernel.org>; Tue, 28 Apr 2026 00:49:33 +0200 (CEST)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1777330177; cv=none;\n b=UdcJwZnvha8wmFXoeAigGDrg6bq4Mlju6TrLtliDXAfiXRR7gpix/GIvN7oZNVHekrvOkDX/yNqBQmPVR9zwxBcMoQ9roBPVxyaZlf8VAkjtJd0Go0p6eSVqBrpfEboOiAOQK1mlAIE34ZXlY2do6HOIA4L1qL+dvLo2wQdPQVE=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1777330177; c=relaxed/simple;\n\tbh=zoAbIRrdAKFpOVTrxKdkyEu/qfxQtjayieagMLT+Nh8=;\n\th=From:To:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=gUFfsSv81wMsxDFNQ7Wg2rR2Aq6yE6qTBNPz84MqZMSaAPgaEfOBTuVYxDEvi8vx7zajMPpS2QLZu+zALZA+KbjU6u9Ld/kQYYBnhZACNUuiAgnbb6uFHUips26jC6C/A9++TJTvQruQ6/dw7eM4gJyH2hrdvIQHWfOhRGJ9orQ=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=none (p=none dis=none) header.from=netfilter.org;\n spf=pass smtp.mailfrom=netfilter.org;\n dkim=pass (2048-bit key) header.d=netfilter.org header.i=@netfilter.org\n header.b=kjBr7p5y; arc=none smtp.client-ip=217.70.190.124", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=netfilter.org;\n\ts=2025; t=1777330174;\n\tbh=EQCBMVFfc2pT8teCqSidZbSDdheBUZC2P5L7/mhKd7I=;\n\th=From:To:Subject:Date:In-Reply-To:References:From;\n\tb=kjBr7p5yK5uUewaFLfiI1DTjA3/SCQvX9uWnQMYrTqVi88078GDxrfAoeYuZNy89K\n\t 1GzQPtQiRJCu4D329E/CI3+Wui4UcXa/2lYx3ZtgWMDQ1N9NqVkxOA6FZdQGbXILfG\n\t sxQW389X31+1B++3/WnMTJMPea1fZ3tGGLHcSdOQOl9TDcV8r92Lt7MZnAzkk+sezZ\n\t Dn6no0AXtrg6oSSjTSnXuBWPviZSe34nv+UDoLWRYDali8vbMZvejceo9LTOL1Furq\n\t 4AiV1oVHmie3Vq0e3+V4BqO5cL4rCJkZ07ZdMsMHfUqnerpTn6uj+M+AsRfpNo1N4a\n\t T/QxAEO4iyKLg==", "From": "Pablo Neira Ayuso <pablo@netfilter.org>", "To": "netfilter-devel@vger.kernel.org", "Subject": "[PATCH nf,v7 2/3] netfilter: nft_fwd_netdev: add device and headroom\n validate with neigh forwarding", "Date": "Tue, 28 Apr 2026 00:49:28 +0200", "Message-ID": "<20260427224929.29868-2-pablo@netfilter.org>", "X-Mailer": "git-send-email 2.47.3", "In-Reply-To": "<20260427224929.29868-1-pablo@netfilter.org>", "References": "<20260427224929.29868-1-pablo@netfilter.org>", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "The ttl field has been decremented already and evaluation of this rule\nwould proceed, just drop this packet instead if there is no destination\ndevice to forwards this packet. This is exactly what nf_dup already does\nin this case.\n\nMoreover, check for headroom and call skb_expand_head() like in the IP\noutput path to ensure there is sufficient headroom when forwarding this\nvia neigh_xmit().\n\nFixes: d32de98ea70f (\"netfilter: nft_fwd_netdev: allow to forward packets via neighbour layer\")\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>\n---\n net/netfilter/nft_fwd_netdev.c | 16 ++++++++++++++--\n 1 file changed, 14 insertions(+), 2 deletions(-)", "diff": "diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c\nindex 2cc809303ce8..605b1d42abce 100644\n--- a/net/netfilter/nft_fwd_netdev.c\n+++ b/net/netfilter/nft_fwd_netdev.c\n@@ -102,6 +102,7 @@ static void nft_fwd_neigh_eval(const struct nft_expr *expr,\n \tstruct sk_buff *skb = pkt->skb;\n \tint nhoff = skb_network_offset(skb);\n \tstruct net_device *dev;\n+\tunsigned int hh_len;\n \tint neigh_table;\n \n \tswitch (priv->nfproto) {\n@@ -153,8 +154,19 @@ static void nft_fwd_neigh_eval(const struct nft_expr *expr,\n \t}\n \n \tdev = dev_get_by_index_rcu(nft_net(pkt), oif);\n-\tif (dev == NULL)\n-\t\treturn;\n+\tif (dev == NULL) {\n+\t\tverdict = NF_DROP;\n+\t\tgoto out;\n+\t}\n+\n+\thh_len = LL_RESERVED_SPACE(dev);\n+\tif (unlikely(skb_headroom(skb) < hh_len && dev->header_ops)) {\n+\t\tskb = skb_expand_head(skb, hh_len);\n+\t\tif (!skb) {\n+\t\t\tverdict = NF_STOLEN;\n+\t\t\tgoto out;\n+\t\t}\n+\t}\n \n \tskb->dev = dev;\n \tskb_clear_tstamp(skb);\n", "prefixes": [ "nf", "v7", "2/3" ] }