Flowtable currently segments GSO packets before adding encapsulation headers, calling nf_flow_encap_push() separately for each segment. Since commit 55a5d8fca836 ("net: pppoe: implement GRO/GSO support"), the PPPoE GSO handler can segment encapsulated packets and update the PPPoE payload length in each resulting segment. Push the encapsulation headers before segmentation and let the PPPoE GSO handler update them. This removes the per-segment encapsulation step from nf_flow_encap_gso_xmit() while keeping the software segmentation. Signed-off-by: Qingfang Deng --- net/netfilter/nf_flow_table_ip.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index c8c29a9a1684..ce69f4e741e2 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -767,12 +767,6 @@ static unsigned int nf_flow_encap_gso_xmit(struct net *net, struct sk_buff *skb, skb_list_walk_safe(segs, segs, nskb) { skb_mark_not_on_list(segs); - - if (nf_flow_encap_push(segs, xmit->tuple, xmit->outdev) < 0) { - kfree_skb(segs); - kfree_skb_list(nskb); - return NF_STOLEN; - } __nf_flow_queue_xmit(net, segs, xmit); } @@ -783,11 +777,12 @@ static unsigned int nf_flow_queue_xmit(struct net *net, struct sk_buff *skb, struct nf_flow_xmit *xmit) { if (xmit->tuple->encap_num) { + if (nf_flow_encap_push(skb, xmit->tuple, xmit->outdev) < 0) + return NF_DROP; + if (skb_is_gso(skb) && xmit->needs_gso_segment) return nf_flow_encap_gso_xmit(net, skb, xmit); - if (nf_flow_encap_push(skb, xmit->tuple, xmit->outdev) < 0) - return NF_DROP; } __nf_flow_queue_xmit(net, skb, xmit); -- 2.43.0