Subject: Re: [PATCH net-next 5/5] net: skbuff: hide nf_trace and ipvs_property

From: Florian Westphal <[email-masked]>
Date: Sat, 15 Apr 2023 01:11:39 +0200

Jakub Kicinski <[email-masked]> wrote:
> On Fri, 14 Apr 2023 23:09:50 +0200 Florian Westphal wrote:
> > > +#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE) || defined(CONFIG_NF_TABLES)
> > >  	__u8			nf_trace:1;  
> > 
> > As already pointed out nftables can be a module, other than that
> 
> I copied it from:
> 
> static inline void nf_reset_trace(struct sk_buff *skb)
> {
> #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE) || defined(CONFIG_NF_TABLES)
> 	skb->nf_trace = 0;
> #endif
> }
>
> I can't quite figure out why this would be intentional.
> Do the existing conditions need to be fixed?

Yes, this is not correct; needs to be "|| IS_ENABLED(CONFIG_NF_TABLES)".

Fixes: 478b360a47b7 ("netfilter: nf_tables: fix nf_trace always-on with XT_TRACE=n")

Let me know if you'd like to add the fix to v2 of your patchset
yourself, otherwise I'll send a fixup patch to netfilter-devel@ on
monday.