On 2/15/22 8:54 PM, menglong8.dong@xxxxxxxxx wrote: > @@ -1779,13 +1789,17 @@ INDIRECT_CALLABLE_SCOPE int tcp_v6_rcv(struct sk_buff *skb) > return ret ? -1 : 0; > > no_tcp_socket: > - if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) > + drop_reason = SKB_DROP_REASON_NO_SOCKET; > + if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) { > + drop_reason = SKB_DROP_REASON_XFRM_POLICY; same here. First failure takes precedence.