Florian Westphal 51e8531371 netfilter: nf_reject: don't leak dst refcount for loopback packets ...

[ Upstream commit 91a79b7922 ]

recent patches to add a WARN() when replacing skb dst entry found an
old bug:

WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline]
WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline]
WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234
[..]
Call Trace:
 nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325
 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27
 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline]
 ..

This is because blamed commit forgot about loopback packets.
Such packets already have a dst_entry attached, even at PRE_ROUTING stage.

Instead of checking hook just check if the skb already has a route
attached to it.

Fixes: f53b9b0bdc ("netfilter: introduce support for reject at prerouting stage")
Signed-off-by: Florian Westphal <fw@strlen.de>
Link: https://patch.msgid.link/20250820123707.10671-1-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2025-08-28 16:31:16 +02:00

..

arp_tables.c

netfilter: Use kmemdup_array instead of kmemdup for multiple allocation

2024-09-03 10:47:16 +02:00

arpt_mangle.c

netfilter: ipv4: prefer skb_ensure_writable

2019-05-31 18:02:46 +02:00

arptable_filter.c

netfilter: arp_tables: allow use of arpt_do_table as hookfn

2021-10-14 23:06:53 +02:00

ip_tables.c

netfilter: Use kmemdup_array instead of kmemdup for multiple allocation

2024-09-03 10:47:16 +02:00

ipt_ah.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500

2019-06-19 17:09:55 +02:00

ipt_ECN.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2019-06-22 08:59:24 -04:00

ipt_REJECT.c

netfilter: use actual socket sk for REJECT action

2020-12-01 14:33:55 +01:00

ipt_rpfilter.c

netfilter: rpfilter: Unmask upper DSCP bits

2024-08-22 16:59:57 -07:00

ipt_SYNPROXY.c

netfilter: Add MODULE_DESCRIPTION entries to kernel modules

2020-06-25 00:50:31 +02:00

iptable_filter.c

netfilter: use NF_DROP instead of -NF_DROP

2024-05-06 16:29:21 +02:00

iptable_mangle.c

netfilter: xt_mangle: only check verdict part of return value

2023-10-18 10:26:43 +02:00

iptable_nat.c

netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init().

2024-07-31 23:20:50 +02:00

iptable_raw.c

netfilter: add missing module descriptions

2023-11-08 13:52:32 +01:00

iptable_security.c

netfilter: iptables: allow use of ipt_do_table as hookfn

2021-10-14 23:06:53 +02:00

Kconfig

netfilter: arptables: Select NETFILTER_FAMILY_ARP when building arp_tables.c

2024-03-28 03:54:02 +01:00

Makefile

netfilter: xtables: allow xtables-nft only builds

2024-01-29 15:43:21 +01:00

nf_defrag_ipv4.c

netfilter: add missing module descriptions

2023-11-08 13:52:32 +01:00

nf_dup_ipv4.c

netfilter: nf_tables: prevent nf_skb_duplicated corruption

2024-09-27 13:55:46 +02:00

nf_nat_h323.c

netfilter: nat: move repetitive nat port reserve loop to a helper

2022-09-07 16:46:04 +02:00

nf_nat_pptp.c

netfilter: conntrack: pptp: use single option structure

2022-02-04 06:30:28 +01:00

nf_nat_snmp_basic_main.c

netfilter: ipv4: prefer skb_ensure_writable

2019-05-31 18:02:46 +02:00

nf_nat_snmp_basic.asn1

treewide: Add SPDX identifier to IETF ASN.1 modules

2023-10-27 18:04:28 +08:00

nf_reject_ipv4.c

netfilter: nf_reject: don't leak dst refcount for loopback packets

2025-08-28 16:31:16 +02:00

nf_socket_ipv4.c

tcp: Access &tcp_hashinfo via net.

2022-09-20 10:21:49 -07:00

nf_tproxy_ipv4.c

netfilter: tproxy: bail out if IP has been disabled on the device

2024-05-29 00:37:51 +02:00

nft_dup_ipv4.c

netfilter: nf_tables: pass context structure to nft_parse_register_load

2024-08-20 12:37:24 +02:00

nft_fib_ipv4.c

netfilter: nf_tables: nft_fib: consistent l3mdev handling

2025-06-19 15:31:53 +02:00

nft_reject_ipv4.c

netfilter: nf_tables: do not reduce read-only expressions

2022-03-20 00:29:46 +01:00