Florian Westphal 51e8531371 netfilter: nf_reject: don't leak dst refcount for loopback packets ... [ Upstream commit 91a79b7922 ] recent patches to add a WARN() when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 [..] Call Trace: nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] .. This is because blamed commit forgot about loopback packets. Such packets already have a dst_entry attached, even at PRE_ROUTING stage. Instead of checking hook just check if the skb already has a route attached to it. Fixes: f53b9b0bdc ("netfilter: introduce support for reject at prerouting stage") Signed-off-by: Florian Westphal <fw@strlen.de> Link: https://patch.msgid.link/20250820123707.10671-1-fw@strlen.de Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-08-28 16:31:16 +02:00
..
ip6_tables.c
ip6t_ah.c
ip6t_eui64.c
ip6t_frag.c
ip6t_hbh.c
ip6t_ipv6header.c
ip6t_mh.c
ip6t_NPT.c
ip6t_REJECT.c
ip6t_rpfilter.c
ip6t_rt.c
ip6t_srh.c
ip6t_SYNPROXY.c
ip6table_filter.c
ip6table_mangle.c
ip6table_nat.c
ip6table_raw.c
ip6table_security.c
Kconfig
Makefile
nf_conntrack_reasm.c
nf_defrag_ipv6_hooks.c
nf_dup_ipv6.c
nf_reject_ipv6.c
nf_socket_ipv6.c
nf_tproxy_ipv6.c
nft_dup_ipv6.c
nft_fib_ipv6.c
nft_reject_ipv6.c