[PATCH net] net: fib: avoid warn splat in flow dissector

[PATCH net] net: fib: avoid warn splat in flow dissector

[Florian Westphal]

New skbs allocated via nf_send_reset() have skb->dev == NULL.

fib*_rules_early_flow_dissect helpers already have a 'struct net'
argument but its not passed down to the flow dissector core, which
will then WARN as it can't derive a net namespace to use:

 WARNING: CPU: 0 PID: 0 at net/core/flow_dissector.c:1016 __skb_flow_dissect+0xa91/0x1cd0
 [..]
  ip_route_me_harder+0x143/0x330
  nf_send_reset+0x17c/0x2d0 [nf_reject_ipv4]
  nft_reject_inet_eval+0xa9/0xf2 [nft_reject_inet]
  nft_do_chain+0x198/0x5d0 [nf_tables]
  nft_do_chain_inet+0xa4/0x110 [nf_tables]
  nf_hook_slow+0x41/0xc0
  ip_local_deliver+0xce/0x110
  ..

Cc: Stanislav Fomichev <sdf@google.com>
Cc: David Ahern <dsahern@kernel.org>
Cc: Ido Schimmel <idosch@nvidia.com>
Fixes: 812fa71f0d96 ("netfilter: Dissect flow after packet mangling")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217826
Signed-off-by: Florian Westphal <fw@strlen.de>
---
 include/net/ip6_fib.h | 5 ++++-
 include/net/ip_fib.h  | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index c9ff23cf313e..1ba9f4ddf2f6 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -642,7 +642,10 @@ static inline bool fib6_rules_early_flow_dissect(struct net *net,
 	if (!net->ipv6.fib6_rules_require_fldissect)
 		return false;
 
-	skb_flow_dissect_flow_keys(skb, flkeys, flag);
+	memset(flkeys, 0, sizeof(*flkeys));
+	__skb_flow_dissect(net, skb, &flow_keys_dissector,
+			   flkeys, NULL, 0, 0, 0, flag);
+
 	fl6->fl6_sport = flkeys->ports.src;
 	fl6->fl6_dport = flkeys->ports.dst;
 	fl6->flowi6_proto = flkeys->basic.ip_proto;
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index a378eff827c7..f0c13864180e 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -418,7 +418,10 @@ static inline bool fib4_rules_early_flow_dissect(struct net *net,
 	if (!net->ipv4.fib_rules_require_fldissect)
 		return false;
 
-	skb_flow_dissect_flow_keys(skb, flkeys, flag);
+	memset(flkeys, 0, sizeof(*flkeys));
+	__skb_flow_dissect(net, skb, &flow_keys_dissector,
+			   flkeys, NULL, 0, 0, 0, flag);
+
 	fl4->fl4_sport = flkeys->ports.src;
 	fl4->fl4_dport = flkeys->ports.dst;
 	fl4->flowi4_proto = flkeys->basic.ip_proto;
-- 
2.41.0

Re: [PATCH net] net: fib: avoid warn splat in flow dissector

[Ido Schimmel]

On Wed, Aug 30, 2023 at 01:00:37PM +0200, Florian Westphal wrote:
> New skbs allocated via nf_send_reset() have skb->dev == NULL.
> 
> fib*_rules_early_flow_dissect helpers already have a 'struct net'
> argument but its not passed down to the flow dissector core, which
> will then WARN as it can't derive a net namespace to use:
> 
>  WARNING: CPU: 0 PID: 0 at net/core/flow_dissector.c:1016 __skb_flow_dissect+0xa91/0x1cd0
>  [..]
>   ip_route_me_harder+0x143/0x330
>   nf_send_reset+0x17c/0x2d0 [nf_reject_ipv4]
>   nft_reject_inet_eval+0xa9/0xf2 [nft_reject_inet]
>   nft_do_chain+0x198/0x5d0 [nf_tables]
>   nft_do_chain_inet+0xa4/0x110 [nf_tables]
>   nf_hook_slow+0x41/0xc0
>   ip_local_deliver+0xce/0x110
>   ..
> 
> Cc: Stanislav Fomichev <sdf@google.com>
> Cc: David Ahern <dsahern@kernel.org>
> Cc: Ido Schimmel <idosch@nvidia.com>
> Fixes: 812fa71f0d96 ("netfilter: Dissect flow after packet mangling")
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=217826
> Signed-off-by: Florian Westphal <fw@strlen.de>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>

Thanks!

Re: [PATCH net] net: fib: avoid warn splat in flow dissector

[David Ahern]

On 8/30/23 5:00 AM, Florian Westphal wrote:
> New skbs allocated via nf_send_reset() have skb->dev == NULL.
> 
> fib*_rules_early_flow_dissect helpers already have a 'struct net'
> argument but its not passed down to the flow dissector core, which
> will then WARN as it can't derive a net namespace to use:
> 
>  WARNING: CPU: 0 PID: 0 at net/core/flow_dissector.c:1016 __skb_flow_dissect+0xa91/0x1cd0
>  [..]
>   ip_route_me_harder+0x143/0x330
>   nf_send_reset+0x17c/0x2d0 [nf_reject_ipv4]
>   nft_reject_inet_eval+0xa9/0xf2 [nft_reject_inet]
>   nft_do_chain+0x198/0x5d0 [nf_tables]
>   nft_do_chain_inet+0xa4/0x110 [nf_tables]
>   nf_hook_slow+0x41/0xc0
>   ip_local_deliver+0xce/0x110
>   ..
> 
> Cc: Stanislav Fomichev <sdf@google.com>
> Cc: David Ahern <dsahern@kernel.org>
> Cc: Ido Schimmel <idosch@nvidia.com>
> Fixes: 812fa71f0d96 ("netfilter: Dissect flow after packet mangling")
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=217826
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
>  include/net/ip6_fib.h | 5 ++++-
>  include/net/ip_fib.h  | 5 ++++-
>  2 files changed, 8 insertions(+), 2 deletions(-)
> 

Reviewed-by: David Ahern <dsahern@kernel.org>

Re: [PATCH net] net: fib: avoid warn splat in flow dissector

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Wed, 30 Aug 2023 13:00:37 +0200 you wrote:
> New skbs allocated via nf_send_reset() have skb->dev == NULL.
> 
> fib*_rules_early_flow_dissect helpers already have a 'struct net'
> argument but its not passed down to the flow dissector core, which
> will then WARN as it can't derive a net namespace to use:
> 
>  WARNING: CPU: 0 PID: 0 at net/core/flow_dissector.c:1016 __skb_flow_dissect+0xa91/0x1cd0
>  [..]
>   ip_route_me_harder+0x143/0x330
>   nf_send_reset+0x17c/0x2d0 [nf_reject_ipv4]
>   nft_reject_inet_eval+0xa9/0xf2 [nft_reject_inet]
>   nft_do_chain+0x198/0x5d0 [nf_tables]
>   nft_do_chain_inet+0xa4/0x110 [nf_tables]
>   nf_hook_slow+0x41/0xc0
>   ip_local_deliver+0xce/0x110
>   ..
> 
> [...]

Here is the summary with links:
  - [net] net: fib: avoid warn splat in flow dissector
    https://git.kernel.org/netdev/net/c/8aae7625ff3f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html