Re: [PATCH nf-next] netfilter: nf_tables: call skb_valid_dst() before skb_dst()

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Fernando,

On Wed, Jul 29, 2026 at 11:33:24AM +0200, Fernando Fernandez Mancera wrote:
> On 7/28/26 10:40 AM, Pablo Neira Ayuso wrote:
> > When fetching the dst_entry from the skb, check if it valid, ie. this is
> > not a template dst.
> > 
> > Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> 
> Hi Pablo,
> 
> I used a coccinelle script to see if this pattern is present in other
> places. So far in Netfilter I have found this in
> net/ipv6/netfilter/nf_reject_ipv6.c:nf_send_reset6()
> 
>         if (!skb_dst(oldskb)) {
>                 nf_ip6_route(net, &dst, flowi6_to_flowi(&fl6), false);
>                 if (!dst)
>                         return;
>                 skb_dst_set(oldskb, dst);
>         }
> 
> If I am not wrong the same problem happens here too.

Good point.

It was intentional, I thought this is never called from netdev
ingress/egress.

I can expand the commit message to explicitly mention that the
intention is to check for valid dst in the netdev/ingress,egrees paths
where the template dst can be seen.

But, after second glance, this can be indeed called from
NF_INET_INGRESS.

So this chunk is really needed, I will post v2, thanks!