On Mon, Feb 28, 2022 at 04:18:05AM +0100, Florian Westphal wrote: > Netfilter assumes its called with rcu_read_lock held, but in egress > hook case it may be called with BH readlock. > > This triggers lockdep splat. > > In order to avoid to change all rcu_dereference() to > rcu_dereference_check(..., rcu_read_lock_bh_held()), wrap nf_hook_slow > with read lock/unlock pair. Applied, thanks