Re: [PATCH net-next v2 0/2] net: flow dissector: allow explicit passing of netns

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

This series got applied to net-next.

But I can trigger this splat via nftables/tests/shell in net.git (6.10-rc).

As well as in -stable 6.1.x:

Jun 26 02:19:26 curiosity kernel: [ 1211.840595] ------------[ cut here ]------------
Jun 26 02:19:26 curiosity kernel: [ 1211.840605] WARNING: CPU: 0 PID: 70274 at net/core/flow_dissector.c:1016 __skb_flow_dissect+0x107e/0x2860
[...]
Jun 26 02:19:26 curiosity kernel: [ 1211.841240] CPU: 0 PID: 70274 Comm: socat Not tainted 6.1.93+ #18

I think that turning this into DEBUG_NET_WARN_ON_ONCE as Willem
suggested provides a workaround for net.git until Florian's fixes in
net-next hit -stable.

Would you accept such a patch?

Thanks.

On Sun, Jun 09, 2024 at 12:10:38AM +0200, Florian Westphal wrote:
> Change since last version:
>  fix kdoc comment warning reported by kbuild robot, no other changes,
>  thus retaining RvB tags from Eric and Willem.
>  v1: https://lore.kernel.org/netdev/20240607083205.3000-1-fw@strlen.de/
> 
> Years ago flow dissector gained ability to delegate flow dissection
> to a bpf program, scoped per netns.
> 
> The netns is derived from skb->dev, and if that is not available, from
> skb->sk.  If neither is set, we hit a (benign) WARN_ON_ONCE().
> 
> This WARN_ON_ONCE can be triggered from netfilter.
> Known skb origins are nf_send_reset and ipv4 stack generated IGMP
> messages.
> 
> Lets allow callers to pass the current netns explicitly and make
> nf_tables use those instead.
> 
> This targets net-next instead of net because the WARN is benign and this
> is not a regression.
> 
> Florian Westphal (2):
>   net: add and use skb_get_hash_net
>   net: add and use __skb_get_hash_symmetric_net
> 
>  include/linux/skbuff.h          | 20 +++++++++++++++++---
>  net/core/flow_dissector.c       | 21 ++++++++++++++-------
>  net/netfilter/nf_tables_trace.c |  2 +-
>  net/netfilter/nft_hash.c        |  3 ++-
>  4 files changed, 34 insertions(+), 12 deletions(-)
> 
> -- 
> 2.44.2
>