Re: [PATCH nf-next,v2 1/3] net: pass net_device_path_ctx struct to dev_fill_forward_path()

On 7/10/26 12:07 PM, Pablo Neira Ayuso wrote:
> Generalize dev_fill_forward_path() so it can be used by the bridge
> family to retrieve the bridge vlan filtering information from the
> bridge port when discovering the bridge flowtable path.
> 
> Signed-off-by: Pablo Neira Ayuso <[email protected]>
> ---
> v2: - move nft_dev_fill_forward_path_init() call after out: goto tag
>       to fix a crash otherwise in the existing flowtable ip family.
> 
>  include/linux/netdevice.h          |  2 +-
>  net/core/dev.c                     | 18 +++++++-----------
>  net/netfilter/nf_flow_table_path.c | 14 ++++++++++++--
>  3 files changed, 20 insertions(+), 14 deletions(-)
> 
> diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
> index 9981d637f8b5..db04b6d2e8d2 100644
> --- a/include/linux/netdevice.h
> +++ b/include/linux/netdevice.h
> @@ -3420,7 +3420,7 @@ void dev_remove_offload(struct packet_offload *po);
>  
>  int dev_get_iflink(const struct net_device *dev);
>  int dev_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb);
> -int dev_fill_forward_path(const struct net_device *dev, const u8 *daddr,
> +int dev_fill_forward_path(struct net_device_path_ctx *ctx,
>  			  struct net_device_path_stack *stack);
>  struct net_device *dev_get_by_name(struct net *net, const char *name);
>  struct net_device *dev_get_by_name_rcu(struct net *net, const char *name);
> diff --git a/net/core/dev.c b/net/core/dev.c
> index 714d05283500..24c384ef9e78 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -750,41 +750,37 @@ static struct net_device_path *dev_fwd_path(struct net_device_path_stack *stack)
>  	return &stack->path[k];
>  }
>  
> -int dev_fill_forward_path(const struct net_device *dev, const u8 *daddr,
> +int dev_fill_forward_path(struct net_device_path_ctx *ctx,
>  			  struct net_device_path_stack *stack)
>  {
>  	const struct net_device *last_dev;
> -	struct net_device_path_ctx ctx = {
> -		.dev	= dev,
> -	};
>  	struct net_device_path *path;
>  	int ret = 0;
>  
> -	memcpy(ctx.daddr, daddr, sizeof(ctx.daddr));
>  	stack->num_paths = 0;
> -	while (ctx.dev && ctx.dev->netdev_ops->ndo_fill_forward_path) {
> -		last_dev = ctx.dev;
> +	while (ctx->dev && ctx->dev->netdev_ops->ndo_fill_forward_path) {
> +		last_dev = ctx->dev;
>  		path = dev_fwd_path(stack);
>  		if (!path)
>  			return -1;
>  
>  		memset(path, 0, sizeof(struct net_device_path));
> -		ret = ctx.dev->netdev_ops->ndo_fill_forward_path(&ctx, path);
> +		ret = ctx->dev->netdev_ops->ndo_fill_forward_path(ctx, path);
>  		if (ret < 0)
>  			return -1;
>  
> -		if (WARN_ON_ONCE(last_dev == ctx.dev))
> +		if (WARN_ON_ONCE(last_dev == ctx->dev))
>  			return -1;
>  	}
>  
> -	if (!ctx.dev)
> +	if (!ctx->dev)
>  		return ret;
>  
>  	path = dev_fwd_path(stack);
>  	if (!path)
>  		return -1;
>  	path->type = DEV_PATH_ETHERNET;
> -	path->dev = ctx.dev;
> +	path->dev = ctx->dev;
>  
>  	return ret;
>  }

Calling dev_fill_forward_path() from nft_dev_fill_bridge_path()
it does not traverse the bridge. It exits at the source "indev"
already. After calling nft_dev_path_info(), the info structure
is filled in with the opposite device and the encaps of the
opposite device.

Would need to add something like this:

int dev_fill_bridge_path(struct net_device_path_ctx *ctx,
			 struct net_device_path_stack *stack)
{
	const struct net_device *last_dev, *br_dev;
	struct net_device_path *path;

	if (!ctx->dev || !netif_is_bridge_port(ctx->dev))
		return -1;

	br_dev = netdev_master_upper_dev_get_rcu((struct net_device *)ctx->dev);
	if (!br_dev || !br_dev->netdev_ops->ndo_fill_forward_path)
		return -1;

	last_dev = ctx->dev;
	path = dev_fwd_path(stack);
	if (!path)
		return -1;

	memset(path, 0, sizeof(struct net_device_path));
	if (br_dev->netdev_ops->ndo_fill_forward_path(ctx, path) < 0)
		return -1;

	if (!ctx->dev || WARN_ON_ONCE(last_dev == ctx->dev))
		return -1;

	return dev_fill_forward_path(ctx, stack);
}
EXPORT_SYMBOL_GPL(dev_fill_bridge_path);

First need to find the bridge device to call ndo_fill_forward_path()
from it.

This also needs the patch "bridge: Add filling forward path from port to
port"
That patch still needs a change according to Nikolay.

> diff --git a/net/netfilter/nf_flow_table_path.c b/net/netfilter/nf_flow_table_path.c
> index 98c03b487f52..5455149e5d9a 100644
> --- a/net/netfilter/nf_flow_table_path.c
> +++ b/net/netfilter/nf_flow_table_path.c
> @@ -42,6 +42,14 @@ static bool nft_is_valid_ether_device(const struct net_device *dev)
>  	return true;
>  }
>  
> +static void nft_dev_fill_forward_path_init(struct net_device_path_ctx *ctx,
> +					   const struct net_device *dev, const u8 *daddr)
> +{
> +	memset(ctx, 0, sizeof(*ctx));
> +	ctx->dev	= dev;
> +	memcpy(ctx->daddr, daddr, sizeof(ctx->daddr));

Need to move:

stack->num_paths = 0;

To here, remove it from dev_fill_forward_path().

> +}
> +
>  static int nft_dev_fill_forward_path(const struct nf_flow_route *route,
>  				     const struct dst_entry *dst_cache,
>  				     const struct nf_conn *ct,
> @@ -50,6 +58,7 @@ static int nft_dev_fill_forward_path(const struct nf_flow_route *route,
>  {
>  	const void *daddr = &ct->tuplehash[!dir].tuple.src.u3;
>  	struct net_device *dev = dst_cache->dev;
> +	struct net_device_path_ctx ctx;
>  	struct neighbour *n;
>  	u8 nud_state;
>  
> @@ -70,9 +79,10 @@ static int nft_dev_fill_forward_path(const struct nf_flow_route *route,
>  
>  	if (!(nud_state & NUD_VALID))
>  		return -1;
> -
>  out:
> -	return dev_fill_forward_path(dev, ha, stack);
> +	nft_dev_fill_forward_path_init(&ctx, dev, ha);
> +
> +	return dev_fill_forward_path(&ctx, stack);
>  }
>  
>  struct nft_forward_info {