From 9bc06340b225f78d98f3955dbd26e451a0ffab74 Mon Sep 17 00:00:00 2001
From: Kevin Krakauer <krakauer@google.com>
Date: Wed, 11 May 2022 11:04:55 -0700
Subject: [PATCH] Describe what iptables checkescape covers specifically

PiperOrigin-RevId: 448037248
---
 pkg/tcpip/stack/iptables.go | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkg/tcpip/stack/iptables.go b/pkg/tcpip/stack/iptables.go
index 5aee1a560..9860acbc1 100644
--- a/pkg/tcpip/stack/iptables.go
+++ b/pkg/tcpip/stack/iptables.go
@@ -275,8 +275,11 @@ type checkTable struct {
 // specified table.
 //
 // This is called in the hot path even when iptables are disabled, so we ensure
-// it does not allocate.
-// +checkescape:heap,builtin
+// it does not allocate. We check recursively for heap allocations, but not for:
+//   - Stack splitting, which can allocate.
+//   - Calls to interfaces, which can allocate.
+//   - Calls to dynamic functions, which can allocate.
+// +checkescape:hard
 func (it *IPTables) shouldSkipOrPopulateTables(tables []checkTable, pkt *PacketBuffer) bool {
 	switch pkt.NetworkProtocolNumber {
 	case header.IPv4ProtocolNumber, header.IPv6ProtocolNumber: