On Wed, Aug 20, 2025 at 03:16:23PM +0200, Pablo Neira Ayuso wrote: > Hi Florian, > > On Wed, Aug 20, 2025 at 02:37:07PM +0200, Florian Westphal wrote: > > recent patches to add a WARN() when replacing skb dst entry found an > > old bug: > > > > WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] > > WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline] > > WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 > > [..] > > Call Trace: > > nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 > > nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 > > expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] > > .. > > > > This is because blamed commit forgot about loopback packets. > > Such packets already have a dst_entry attached, even at PRE_ROUTING stage. > > > > Instead of checking hook just check if the skb already has a route > > attached to it. > > Quick question: does inconditional route lookup work for br_netfilter? Never mind, it should be fine, the fake dst get attached to the skb.
