netdev - Re: [PATCH net] netfilter: nf_reject: don't leak dst refcount for loopback packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aKXLsoLkSdnEU_at@calendula>
Date: Wed, 20 Aug 2025 15:20:50 +0200
From: Pablo Neira Ayuso <pablo@...filter.org>
To: Florian Westphal <fw@...len.de>
Cc: netdev@...r.kernel.org, Paolo Abeni <pabeni@...hat.com>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, netfilter-devel@...r.kernel.org
Subject: Re: [PATCH net] netfilter: nf_reject: don't leak dst refcount for
 loopback packets

On Wed, Aug 20, 2025 at 03:16:23PM +0200, Pablo Neira Ayuso wrote:
> Hi Florian,
> 
> On Wed, Aug 20, 2025 at 02:37:07PM +0200, Florian Westphal wrote:
> > recent patches to add a WARN() when replacing skb dst entry found an
> > old bug:
> > 
> > WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline]
> > WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline]
> > WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234
> > [..]
> > Call Trace:
> >  nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325
> >  nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27
> >  expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline]
> >  ..
> > 
> > This is because blamed commit forgot about loopback packets.
> > Such packets already have a dst_entry attached, even at PRE_ROUTING stage.
> > 
> > Instead of checking hook just check if the skb already has a route
> > attached to it.
> 
> Quick question: does inconditional route lookup work for br_netfilter?

Never mind, it should be fine, the fake dst get attached to the skb.