Commit 91a79b79 authored by Florian Westphal's avatar Florian Westphal Committed by Jakub Kicinski
Browse files

netfilter: nf_reject: don't leak dst refcount for loopback packets 



recent patches to add a WARN() when replacing skb dst entry found an
old bug:

WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline]
WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline]
WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234
[..]
Call Trace:
 nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325
 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27
 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline]
 ..

This is because blamed commit forgot about loopback packets.
Such packets already have a dst_entry attached, even at PRE_ROUTING stage.

Instead of checking hook just check if the skb already has a route
attached to it.

Fixes: f53b9b0b ("netfilter: introduce support for reject at prerouting stage")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Link: https://patch.msgid.link/20250820123707.10671-1-fw@strlen.de


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 1b78236a

net/ipv4/netfilter/nf_reject_ipv4.c

+2 −4
Original line number Diff line number Diff line
@@ -247,8 +247,7 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb, 
	if (!oth)

		return;



	if ((hook == NF_INET_PRE_ROUTING || hook == NF_INET_INGRESS) &&

	    nf_reject_fill_skb_dst(oldskb) < 0)

	if (!skb_dst(oldskb) && nf_reject_fill_skb_dst(oldskb) < 0)

		return;



	if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
@@ -321,8 +320,7 @@ void nf_send_unreach(struct sk_buff *skb_in, int code, int hook) 
	if (iph->frag_off & htons(IP_OFFSET))

		return;



	if ((hook == NF_INET_PRE_ROUTING || hook == NF_INET_INGRESS) &&

	    nf_reject_fill_skb_dst(skb_in) < 0)

	if (!skb_dst(skb_in) && nf_reject_fill_skb_dst(skb_in) < 0)

		return;



	if (skb_csum_unnecessary(skb_in) ||

net/ipv6/netfilter/nf_reject_ipv6.c

+2 −3
Original line number Diff line number Diff line
@@ -293,7 +293,7 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb, 
	fl6.fl6_sport = otcph->dest;

	fl6.fl6_dport = otcph->source;



	if (hook == NF_INET_PRE_ROUTING || hook == NF_INET_INGRESS) {

	if (!skb_dst(oldskb)) {

		nf_ip6_route(net, &dst, flowi6_to_flowi(&fl6), false);

		if (!dst)

			return;
@@ -397,8 +397,7 @@ void nf_send_unreach6(struct net *net, struct sk_buff *skb_in, 
	if (hooknum == NF_INET_LOCAL_OUT && skb_in->dev == NULL)

		skb_in->dev = net->loopback_dev;



	if ((hooknum == NF_INET_PRE_ROUTING || hooknum == NF_INET_INGRESS) &&

	    nf_reject6_fill_skb_dst(skb_in) < 0)

	if (!skb_dst(skb_in) && nf_reject6_fill_skb_dst(skb_in) < 0)

		return;



	icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0);