Patch "net: fib: avoid warn splat in flow dissector" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: fib: avoid warn splat in flow dissector

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-fib-avoid-warn-splat-in-flow-dissector.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 06b466b6777c5fa4560c05b91d7cd095836e1954
Author: Florian Westphal <fw@xxxxxxxxx>
Date:   Wed Aug 30 13:00:37 2023 +0200

    net: fib: avoid warn splat in flow dissector
    
    [ Upstream commit 8aae7625ff3f0bd5484d01f1b8d5af82e44bec2d ]
    
    New skbs allocated via nf_send_reset() have skb->dev == NULL.
    
    fib*_rules_early_flow_dissect helpers already have a 'struct net'
    argument but its not passed down to the flow dissector core, which
    will then WARN as it can't derive a net namespace to use:
    
     WARNING: CPU: 0 PID: 0 at net/core/flow_dissector.c:1016 __skb_flow_dissect+0xa91/0x1cd0
     [..]
      ip_route_me_harder+0x143/0x330
      nf_send_reset+0x17c/0x2d0 [nf_reject_ipv4]
      nft_reject_inet_eval+0xa9/0xf2 [nft_reject_inet]
      nft_do_chain+0x198/0x5d0 [nf_tables]
      nft_do_chain_inet+0xa4/0x110 [nf_tables]
      nf_hook_slow+0x41/0xc0
      ip_local_deliver+0xce/0x110
      ..
    
    Cc: Stanislav Fomichev <sdf@xxxxxxxxxx>
    Cc: David Ahern <dsahern@xxxxxxxxxx>
    Cc: Ido Schimmel <idosch@xxxxxxxxxx>
    Fixes: 812fa71f0d96 ("netfilter: Dissect flow after packet mangling")
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=217826
    Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
    Reviewed-by: Ido Schimmel <idosch@xxxxxxxxxx>
    Reviewed-by: David Ahern <dsahern@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230830110043.30497-1-fw@xxxxxxxxx
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index bbb27639f2933..d72cee4dff70b 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -610,7 +610,10 @@ static inline bool fib6_rules_early_flow_dissect(struct net *net,
 	if (!net->ipv6.fib6_rules_require_fldissect)
 		return false;
 
-	skb_flow_dissect_flow_keys(skb, flkeys, flag);
+	memset(flkeys, 0, sizeof(*flkeys));
+	__skb_flow_dissect(net, skb, &flow_keys_dissector,
+			   flkeys, NULL, 0, 0, 0, flag);
+
 	fl6->fl6_sport = flkeys->ports.src;
 	fl6->fl6_dport = flkeys->ports.dst;
 	fl6->flowi6_proto = flkeys->basic.ip_proto;
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 3417ba2d27ad6..c3324a1949c3a 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -415,7 +415,10 @@ static inline bool fib4_rules_early_flow_dissect(struct net *net,
 	if (!net->ipv4.fib_rules_require_fldissect)
 		return false;
 
-	skb_flow_dissect_flow_keys(skb, flkeys, flag);
+	memset(flkeys, 0, sizeof(*flkeys));
+	__skb_flow_dissect(net, skb, &flow_keys_dissector,
+			   flkeys, NULL, 0, 0, 0, flag);
+
 	fl4->fl4_sport = flkeys->ports.src;
 	fl4->fl4_dport = flkeys->ports.dst;
 	fl4->flowi4_proto = flkeys->basic.ip_proto;