Florian Westphal 82ef97abf2 netfilter: nf_reject: don't leak dst refcount for loopback packets ... [ Upstream commit 91a79b792204313153e1bdbbe5acbfc28903b3a5 ] recent patches to add a WARN() when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 [..] Call Trace: nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] .. This is because blamed commit forgot about loopback packets. Such packets already have a dst_entry attached, even at PRE_ROUTING stage. Instead of checking hook just check if the skb already has a route attached to it. Fixes: f53b9b0bdc ("netfilter: introduce support for reject at prerouting stage") Signed-off-by: Florian Westphal <fw@strlen.de> Link: https://patch.msgid.link/20250820123707.10671-1-fw@strlen.de Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-08-28 16:24:39 +02:00
..
ip6_tables.c
ip6t_ah.c
ip6t_eui64.c
ip6t_frag.c
ip6t_hbh.c
ip6t_ipv6header.c
ip6t_mh.c
ip6t_NPT.c
ip6t_REJECT.c
ip6t_rpfilter.c	netfilter: ip6t_rpfilter: Fix regression with VRF interfaces	2024-10-17 15:12:01 +02:00
ip6t_rt.c
ip6t_srh.c
ip6t_SYNPROXY.c
ip6table_filter.c
ip6table_mangle.c
ip6table_nat.c	netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init().	2024-08-19 05:45:32 +02:00
ip6table_raw.c
ip6table_security.c
Kconfig
Makefile
nf_conntrack_reasm.c	inet: inet_defrag: prevent sk release while still in use	2024-10-17 15:10:41 +02:00
nf_defrag_ipv6_hooks.c
nf_dup_ipv6.c	netfilter: nf_tables: prevent nf_skb_duplicated corruption	2024-10-17 15:11:20 +02:00
nf_flow_table_ipv6.c
nf_reject_ipv6.c	netfilter: nf_reject: don't leak dst refcount for loopback packets	2025-08-28 16:24:39 +02:00
nf_socket_ipv6.c	netfilter: socket: Lookup orig tuple for IPv6 SNAT	2025-04-10 14:31:56 +02:00
nf_tproxy_ipv6.c
nft_dup_ipv6.c
nft_fib_ipv6.c	netfilter: nf_tables: nft_fib_ipv6: fix VRF ipv4/ipv6 result discrepancy	2025-06-27 11:05:13 +01:00
nft_reject_ipv6.c