On Tue, Apr 09, 2019 at 06:56:12AM +0000, Rundong Ge wrote: [...] > diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c > index 0dcc359..57eb02d 100644 > --- a/net/netfilter/nfnetlink_queue.c > +++ b/net/netfilter/nfnetlink_queue.c > @@ -905,13 +905,25 @@ static void free_entry(struct nf_queue_entry *entry) > dev_cmp(struct nf_queue_entry *entry, unsigned long ifindex) > { > #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) > - int physinif, physoutif; > + struct net_device *physindev, *physoutdev; > + struct net_bridge_port *port; > > - physinif = nf_bridge_get_physinif(entry->skb); > - physoutif = nf_bridge_get_physoutif(entry->skb); > - > - if (physinif == ifindex || physoutif == ifindex) > - return 1; > + physindev = nf_bridge_get_physindev(entry->skb); > + physoutdev = nf_bridge_get_physoutdev(entry->skb); > + if (physindev) { > + if (physindev->ifindex == ifindex) > + return 1; > + port = br_port_get_rcu(physindev); > + if (port && port->br->dev->ifindex == ifindex) > + return 1; > + } > + if (physoutdev) { > + if (physoutdev->ifindex == ifindex) > + return 1; > + port = br_port_get_rcu(physoutdev); > + if (port && port->br->dev->ifindex == ifindex) > + return 1; > + } Either entry->state.in and entry->state.out point to the bridge device, after this #endif. > #endif > if (entry->state.in) > if (entry->state.in->ifindex == ifindex) > -- > 1.8.3.1 >