From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: netdev@vger.kernel.org, Paolo Abeni <pabeni@redhat.com>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>,
netfilter-devel@vger.kernel.org
Subject: Re: [PATCH net 4/9] netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
Date: Wed, 1 Jul 2026 14:23:38 +0200 [thread overview]
Message-ID: <akUGynHszNDwFjJ6@chamomile> (raw)
In-Reply-To: <akTzomC4Qz8u8teJ@chamomile>
On Wed, Jul 01, 2026 at 01:01:58PM +0200, Pablo Neira Ayuso wrote:
> On Wed, Jul 01, 2026 at 08:36:11AM +0200, Florian Westphal wrote:
> > Florian Westphal <fw@strlen.de> wrote:
> > > From: Pablo Neira Ayuso <pablo@netfilter.org>
> > >
> > > tc ingress and openvswitch do not guarantee routing information to be
> > > available. These subsystems use the conntrack helper infrastructure, and
> > > the SIP helper relies on the skb_dst() to be present if
> > > sip_external_media is set to 1 (which is disabled by default as a module
> > > parameter).
> >
> > The sashiko drive-by appears real, I submitted a patch for it.
> > Its not a regression added by this patch but a unrelated issue.
> >
> > https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260701062922.9660-1-fw@strlen.de/
>
> Is skb_ensure_writable() bogus here?
>
> As you said, skb is already linearized. As for clones, they should
> only happen in br_netfilter? In such case, it should be br_netfilter
> that should be audited not to pass cloned skbuffs before calling the
> inet hooks.
Forget this, this skb_ensure_writable() is really needed here.
next prev parent reply other threads:[~2026-07-01 12:23 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-30 4:52 [PATCH net 0/9] netfilter: updates for net Florian Westphal
2026-06-30 4:52 ` [PATCH net 1/9] netfilter: nf_conntrack_expect: zero at allocation time Florian Westphal
2026-07-01 17:10 ` patchwork-bot+netdevbpf
2026-06-30 4:52 ` [PATCH net 2/9] netfilter: nft_set_pipapo: don't leak bad clone into future transaction Florian Westphal
2026-06-30 4:52 ` [PATCH net 3/9] netfilter: ipset: fix race between dump and ip_set_list resize Florian Westphal
2026-07-01 5:09 ` Florian Westphal
2026-07-01 20:33 ` Xiang Mei
2026-06-30 4:52 ` [PATCH net 4/9] netfilter: nf_conntrack_sip: validate skb_dst() before accessing it Florian Westphal
2026-07-01 6:36 ` Florian Westphal
2026-07-01 11:01 ` Pablo Neira Ayuso
2026-07-01 12:23 ` Pablo Neira Ayuso [this message]
2026-06-30 4:52 ` [PATCH net 5/9] netfilter: nfnetlink_cthelper: cap to maximum number of expectation per master Florian Westphal
2026-07-01 5:04 ` Florian Westphal
2026-06-30 4:52 ` [PATCH net 6/9] netfilter: nft_fib: reject fib expression on the netdev egress hook Florian Westphal
2026-06-30 4:52 ` [PATCH net 7/9] netfilter: nfnetlink_queue: restrict writes to network header Florian Westphal
2026-06-30 4:52 ` [PATCH net 8/9] netfilter: nftables: restrict linklayer and network header writes Florian Westphal
2026-06-30 4:52 ` [PATCH net 9/9] netfilter: nftables: restrict checkum update offset Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=akUGynHszNDwFjJ6@chamomile \
--to=pablo@netfilter.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.