netfilter: nf_reject: don't leak dst refcount for loopback packets

recent patches to add a WARN() when replacing skb dst entry found an
old bug:

WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline]
WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline]
WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234
[..]
Call Trace:
 nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325
 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27
 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline]
 ..

This is because blamed commit forgot about loopback packets.
Such packets already have a dst_entry attached, even at PRE_ROUTING stage.

Instead of checking hook just check if the skb already has a route
attached to it.

Fixes: f53b9b0bdc59 ("netfilter: introduce support for reject at prerouting stage")
Signed-off-by: Florian Westphal <fw@strlen.de>
Link: https://patch.msgid.link/20250820123707.10671-1-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index 87fd945a0d27a5506cc20b8a5ff4d53a0eb1bc60..0d3cb2ba6fc84164dc513049ec4c7dbff652425e 100644 (file)
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -247,8 +247,7 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb,
        if (!oth)
                return;
 
-       if ((hook == NF_INET_PRE_ROUTING || hook == NF_INET_INGRESS) &&
-           nf_reject_fill_skb_dst(oldskb) < 0)
+       if (!skb_dst(oldskb) && nf_reject_fill_skb_dst(oldskb) < 0)
                return;
 
        if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
@@ -321,8 +320,7 @@ void nf_send_unreach(struct sk_buff *skb_in, int code, int hook)
        if (iph->frag_off & htons(IP_OFFSET))
                return;
 
-       if ((hook == NF_INET_PRE_ROUTING || hook == NF_INET_INGRESS) &&
-           nf_reject_fill_skb_dst(skb_in) < 0)
+       if (!skb_dst(skb_in) && nf_reject_fill_skb_dst(skb_in) < 0)
                return;
 
        if (skb_csum_unnecessary(skb_in) ||

diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index 838295fa32e36426a07645d215920d373e742f91..cb2d38e80de9a6494d75e3bc503222d9204acfb2 100644 (file)
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -293,7 +293,7 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,
        fl6.fl6_sport = otcph->dest;
        fl6.fl6_dport = otcph->source;
 
-       if (hook == NF_INET_PRE_ROUTING || hook == NF_INET_INGRESS) {
+       if (!skb_dst(oldskb)) {
                nf_ip6_route(net, &dst, flowi6_to_flowi(&fl6), false);
                if (!dst)
                        return;
@@ -397,8 +397,7 @@ void nf_send_unreach6(struct net *net, struct sk_buff *skb_in,
        if (hooknum == NF_INET_LOCAL_OUT && skb_in->dev == NULL)
                skb_in->dev = net->loopback_dev;
 
-       if ((hooknum == NF_INET_PRE_ROUTING || hooknum == NF_INET_INGRESS) &&
-           nf_reject6_fill_skb_dst(skb_in) < 0)
+       if (!skb_dst(skb_in) && nf_reject6_fill_skb_dst(skb_in) < 0)
                return;
 
        icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0);