[PATCH net] netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

[PATCH net] netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

[Eric Dumazet]

Incoming skbs passing through netfilter flowtable offload hooks (or XFRM
offload path) might already carry a ref-counted dst_entry assigned during
earlier RX or routing steps.

Calling skb_dst_set_noref() when skb already holds a ref-counted dst
overwrites skb->_skb_refdst, leaking the previous dst_entry reference
count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in
skb_dst_check_unset():

  WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170
  WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234
  WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864

Drop any existing dst_entry reference with skb_dst_drop(skb) before
setting the non-referenced flowtable destination.

Fixes: 2a79fd3908ac ("netfilter: nf_flow_table: attach dst to skbs")
Reported-by: syzbot+76d4e3a055aec3b007ec@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a71b141.9511d2ce.1fc5b9.033b.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/netfilter/nf_flow_table_ip.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c
index 0b78decce8a9bdc3ed404f9913384335408b00d3..c9e332fafcb5c22559f68858b36f3207822c4423 100644
--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
@@ -310,6 +310,7 @@ static unsigned int nf_flow_xmit_xfrm(struct sk_buff *skb,
 				      struct dst_entry *dst)
 {
 	skb_orphan(skb);
+	skb_dst_drop(skb);
 	skb_dst_set_noref(skb, dst);
 	dst_output(state->net, state->sk, skb);
 	return NF_STOLEN;
@@ -861,6 +862,7 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
 			return NF_DROP;
 		}
 		xmit.dest = neigh->ha;
+		skb_dst_drop(skb);
 		skb_dst_set_noref(skb, &rt->dst);
 		break;
 	case FLOW_OFFLOAD_XMIT_DIRECT:
@@ -1178,6 +1180,7 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
 			return NF_DROP;
 		}
 		xmit.dest = neigh->ha;
+		skb_dst_drop(skb);
 		skb_dst_set_noref(skb, &rt->dst);
 		break;
 	case FLOW_OFFLOAD_XMIT_DIRECT:
-- 
2.55.0.571.g244d577d93-goog

Re: [PATCH net] netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

[Pablo Neira Ayuso]

On Tue, Aug 04, 2026 at 09:33:28AM +0000, Eric Dumazet wrote:
> Incoming skbs passing through netfilter flowtable offload hooks (or XFRM
> offload path) might already carry a ref-counted dst_entry assigned during
> earlier RX or routing steps.
> 
> Calling skb_dst_set_noref() when skb already holds a ref-counted dst
> overwrites skb->_skb_refdst, leaking the previous dst_entry reference
> count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in
> skb_dst_check_unset():
> 
>   WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170
>   WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234
>   WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864
> 
> Drop any existing dst_entry reference with skb_dst_drop(skb) before
> setting the non-referenced flowtable destination.
> 
> Fixes: 2a79fd3908ac ("netfilter: nf_flow_table: attach dst to skbs")
> Reported-by: syzbot+76d4e3a055aec3b007ec@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/6a71b141.9511d2ce.1fc5b9.033b.GAE@google.com/T/#u
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>

Re: [PATCH net] netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue,  4 Aug 2026 09:33:28 +0000 you wrote:
> Incoming skbs passing through netfilter flowtable offload hooks (or XFRM
> offload path) might already carry a ref-counted dst_entry assigned during
> earlier RX or routing steps.
> 
> Calling skb_dst_set_noref() when skb already holds a ref-counted dst
> overwrites skb->_skb_refdst, leaking the previous dst_entry reference
> count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in
> skb_dst_check_unset():
> 
> [...]

Here is the summary with links:
  - [net] netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
    https://git.kernel.org/netdev/net/c/8aecf0bbcc72

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html