Re: [PATCH net v3 1/1] seg6: validate state in netfilter continuations

[Paolo Abeni <pabeni@redhat.com>]

On 10/24/26 09:23, Ren Wei wrote:
> From: Zixuan Chai <petalzu987@gmail.com>
> 
> Netfilter hooks can replace or drop skb_dst() before an SRv6 continuation
> resumes. The continuation callbacks then assume that the current dst still
> contains the expected lwtstate, which can lead to invalid state access.
> 
> Validate the current dst and lwtstate in each NF_HOOK() okfn wrapper.
> Drop the skb when the state is missing or has the wrong type. Keep the
> direct core calls unchanged when nf_hooks_lwtunnel is off.
> 
> Fixes: 7a3f5b0de364 ("netfilter: add netfilter hooks to SRv6 data plane")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/20260720204430.1886091-1-xmei5@asu.edu
> Assisted-by: LLM
Minor nir: the above tag should not be added anymore.

> @@ -624,10 +648,10 @@ static int seg6_input_nf(struct sk_buff *skb)
>   	switch (skb->protocol) {
>   	case htons(ETH_P_IP):
>   		return NF_HOOK(NFPROTO_IPV4, NF_INET_POST_ROUTING, net, NULL,
> -			       skb, NULL, dev, seg6_input_core);
> +				       skb, NULL, dev, seg6_input_core_nf);
>   	case htons(ETH_P_IPV6):
>   		return NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING, net, NULL,
> -			       skb, NULL, dev, seg6_input_core);
> +				       skb, NULL, dev, seg6_input_core_nf);

Please do not include unneeded whitespaces-only changes. There is a similar
chunk below.

Other than that the patch LGTM, but when resubmitting please do not include
the unneeded cover letter.

Thanks,

Paolo