net: netfilter: use kfree_drop_reason() for NF_DROP

Replace kfree_skb() with kfree_skb_reason() in nf_hook_slow() when
skb is dropped by reason of NF_DROP. Following new drop reasons
are introduced:

SKB_DROP_REASON_NETFILTER_DROP

Signed-off-by: Menglong Dong <imagedong@tencent.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index f04e3a1f4455d914e93a9425157f8b052b59464a..9060159b437568288efa6b44a01239a0c0e8dec3 100644 (file)
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -320,6 +320,7 @@ enum skb_drop_reason {
        SKB_DROP_REASON_TCP_CSUM,       /* TCP checksum error */
        SKB_DROP_REASON_SOCKET_FILTER,  /* dropped by socket filter */
        SKB_DROP_REASON_UDP_CSUM,       /* UDP checksum error */
+       SKB_DROP_REASON_NETFILTER_DROP, /* dropped by netfilter */
        SKB_DROP_REASON_MAX,
 };
 

diff --git a/include/trace/events/skb.h b/include/trace/events/skb.h
index a8a64b97504d8a5d0a743a58c4cd5cb2625f0a83..3d89f7b09a438a1b873738361725cb9a2d2b5952 100644 (file)
--- a/include/trace/events/skb.h
+++ b/include/trace/events/skb.h
@@ -16,6 +16,7 @@
        EM(SKB_DROP_REASON_TCP_CSUM, TCP_CSUM)                  \
        EM(SKB_DROP_REASON_SOCKET_FILTER, SOCKET_FILTER)        \
        EM(SKB_DROP_REASON_UDP_CSUM, UDP_CSUM)                  \
+       EM(SKB_DROP_REASON_NETFILTER_DROP, NETFILTER_DROP)      \
        EMe(SKB_DROP_REASON_MAX, MAX)
 
 #undef EM

diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 354cb472f386797d77667b02e0790072b333f40e..d1c9dfbb11fa3874333b5d25db2d5c56a300149e 100644 (file)
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -621,7 +621,8 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state,
                case NF_ACCEPT:
                        break;
                case NF_DROP:
-                       kfree_skb(skb);
+                       kfree_skb_reason(skb,
+                                        SKB_DROP_REASON_NETFILTER_DROP);
                        ret = NF_DROP_GETERR(verdict);
                        if (ret == 0)
                                ret = -EPERM;