| Message ID | 20230830110043.30497-1-fw@strlen.de (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 8aae7625ff3f0bd5484d01f1b8d5af82e44bec2d |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] net: fib: avoid warn splat in flow dissector | expand |
On Wed, Aug 30, 2023 at 01:00:37PM +0200, Florian Westphal wrote: > New skbs allocated via nf_send_reset() have skb->dev == NULL. > > fib*_rules_early_flow_dissect helpers already have a 'struct net' > argument but its not passed down to the flow dissector core, which > will then WARN as it can't derive a net namespace to use: > > WARNING: CPU: 0 PID: 0 at net/core/flow_dissector.c:1016 __skb_flow_dissect+0xa91/0x1cd0 > [..] > ip_route_me_harder+0x143/0x330 > nf_send_reset+0x17c/0x2d0 [nf_reject_ipv4] > nft_reject_inet_eval+0xa9/0xf2 [nft_reject_inet] > nft_do_chain+0x198/0x5d0 [nf_tables] > nft_do_chain_inet+0xa4/0x110 [nf_tables] > nf_hook_slow+0x41/0xc0 > ip_local_deliver+0xce/0x110 > .. > > Cc: Stanislav Fomichev <sdf@google.com> > Cc: David Ahern <dsahern@kernel.org> > Cc: Ido Schimmel <idosch@nvidia.com> > Fixes: 812fa71f0d96 ("netfilter: Dissect flow after packet mangling") > Link: https://bugzilla.kernel.org/show_bug.cgi?id=217826 > Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Thanks!
On 8/30/23 5:00 AM, Florian Westphal wrote: > New skbs allocated via nf_send_reset() have skb->dev == NULL. > > fib*_rules_early_flow_dissect helpers already have a 'struct net' > argument but its not passed down to the flow dissector core, which > will then WARN as it can't derive a net namespace to use: > > WARNING: CPU: 0 PID: 0 at net/core/flow_dissector.c:1016 __skb_flow_dissect+0xa91/0x1cd0 > [..] > ip_route_me_harder+0x143/0x330 > nf_send_reset+0x17c/0x2d0 [nf_reject_ipv4] > nft_reject_inet_eval+0xa9/0xf2 [nft_reject_inet] > nft_do_chain+0x198/0x5d0 [nf_tables] > nft_do_chain_inet+0xa4/0x110 [nf_tables] > nf_hook_slow+0x41/0xc0 > ip_local_deliver+0xce/0x110 > .. > > Cc: Stanislav Fomichev <sdf@google.com> > Cc: David Ahern <dsahern@kernel.org> > Cc: Ido Schimmel <idosch@nvidia.com> > Fixes: 812fa71f0d96 ("netfilter: Dissect flow after packet mangling") > Link: https://bugzilla.kernel.org/show_bug.cgi?id=217826 > Signed-off-by: Florian Westphal <fw@strlen.de> > --- > include/net/ip6_fib.h | 5 ++++- > include/net/ip_fib.h | 5 ++++- > 2 files changed, 8 insertions(+), 2 deletions(-) > Reviewed-by: David Ahern <dsahern@kernel.org>
Hello: This patch was applied to netdev/net.git (main) by Paolo Abeni <pabeni@redhat.com>: On Wed, 30 Aug 2023 13:00:37 +0200 you wrote: > New skbs allocated via nf_send_reset() have skb->dev == NULL. > > fib*_rules_early_flow_dissect helpers already have a 'struct net' > argument but its not passed down to the flow dissector core, which > will then WARN as it can't derive a net namespace to use: > > WARNING: CPU: 0 PID: 0 at net/core/flow_dissector.c:1016 __skb_flow_dissect+0xa91/0x1cd0 > [..] > ip_route_me_harder+0x143/0x330 > nf_send_reset+0x17c/0x2d0 [nf_reject_ipv4] > nft_reject_inet_eval+0xa9/0xf2 [nft_reject_inet] > nft_do_chain+0x198/0x5d0 [nf_tables] > nft_do_chain_inet+0xa4/0x110 [nf_tables] > nf_hook_slow+0x41/0xc0 > ip_local_deliver+0xce/0x110 > .. > > [...] Here is the summary with links: - [net] net: fib: avoid warn splat in flow dissector https://git.kernel.org/netdev/net/c/8aae7625ff3f You are awesome, thank you!
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h index c9ff23cf313e..1ba9f4ddf2f6 100644 --- a/include/net/ip6_fib.h +++ b/include/net/ip6_fib.h @@ -642,7 +642,10 @@ static inline bool fib6_rules_early_flow_dissect(struct net *net, if (!net->ipv6.fib6_rules_require_fldissect) return false; - skb_flow_dissect_flow_keys(skb, flkeys, flag); + memset(flkeys, 0, sizeof(*flkeys)); + __skb_flow_dissect(net, skb, &flow_keys_dissector, + flkeys, NULL, 0, 0, 0, flag); + fl6->fl6_sport = flkeys->ports.src; fl6->fl6_dport = flkeys->ports.dst; fl6->flowi6_proto = flkeys->basic.ip_proto; diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h index a378eff827c7..f0c13864180e 100644 --- a/include/net/ip_fib.h +++ b/include/net/ip_fib.h @@ -418,7 +418,10 @@ static inline bool fib4_rules_early_flow_dissect(struct net *net, if (!net->ipv4.fib_rules_require_fldissect) return false; - skb_flow_dissect_flow_keys(skb, flkeys, flag); + memset(flkeys, 0, sizeof(*flkeys)); + __skb_flow_dissect(net, skb, &flow_keys_dissector, + flkeys, NULL, 0, 0, 0, flag); + fl4->fl4_sport = flkeys->ports.src; fl4->fl4_dport = flkeys->ports.dst; fl4->flowi4_proto = flkeys->basic.ip_proto;
New skbs allocated via nf_send_reset() have skb->dev == NULL. fib*_rules_early_flow_dissect helpers already have a 'struct net' argument but its not passed down to the flow dissector core, which will then WARN as it can't derive a net namespace to use: WARNING: CPU: 0 PID: 0 at net/core/flow_dissector.c:1016 __skb_flow_dissect+0xa91/0x1cd0 [..] ip_route_me_harder+0x143/0x330 nf_send_reset+0x17c/0x2d0 [nf_reject_ipv4] nft_reject_inet_eval+0xa9/0xf2 [nft_reject_inet] nft_do_chain+0x198/0x5d0 [nf_tables] nft_do_chain_inet+0xa4/0x110 [nf_tables] nf_hook_slow+0x41/0xc0 ip_local_deliver+0xce/0x110 .. Cc: Stanislav Fomichev <sdf@google.com> Cc: David Ahern <dsahern@kernel.org> Cc: Ido Schimmel <idosch@nvidia.com> Fixes: 812fa71f0d96 ("netfilter: Dissect flow after packet mangling") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217826 Signed-off-by: Florian Westphal <fw@strlen.de> --- include/net/ip6_fib.h | 5 ++++- include/net/ip_fib.h | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-)