Subject: Re: [PATCH nf] netfilter: nf_reject: init skb->dev for reset packet

From: Florian Westphal <[email-masked]>
Date: Thu, 6 Jun 2024 10:39:05 +0200

Willem de Bruijn <[email-masked]> wrote:
> On Wed, Jun 5, 2024 at 3:45 PM Pablo Neira Ayuso <[email-masked]> wrote:
> >
> > On Wed, Jun 05, 2024 at 09:08:33PM +0200, Florian Westphal wrote:
> > > So there are several options here:
> > > 1. remove the WARN_ON_ONCE and be done with it
> > > 2. remove the WARN_ON_ONCE and pretend net was init_net
> > > 3. also look at skb_dst(skb)->dev if skb->dev is unset, then back to 1)
> > >    or 2)
> > > 4. stop using skb_get_hash() from netfilter (but there are likely other
> > >    callers that might hit this).
> > > 5. fix up callers, one by one
> > > 6. assign skb->dev inside netfilter if its unset
> 
> Is 6 a realistic option?

The output hook has to outdev available (its skb_dst(skb)->dev, passed
in from __ip_local_out()).

So we could set skb->dev = outdev, before calling skb_get_hash and
__skb_get_hash_symmetric.