Patch "ipvs: Always clear ipvs_property flag in skb_scrub_packet()" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ipvs: Always clear ipvs_property flag in skb_scrub_packet()

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ipvs-always-clear-ipvs_property-flag-in-skb_scrub_pa.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit fe74c8df03cdb1fe7dd7f34e5fdb09c8a979bd5f
Author: Philo Lu <lulie@xxxxxxxxxxxxxxxxx>
Date:   Sat Feb 22 11:35:18 2025 +0800

    ipvs: Always clear ipvs_property flag in skb_scrub_packet()
    
    [ Upstream commit de2c211868b9424f9aa9b3432c4430825bafb41b ]
    
    We found an issue when using bpf_redirect with ipvs NAT mode after
    commit ff70202b2d1a ("dev_forward_skb: do not scrub skb mark within
    the same name space"). Particularly, we use bpf_redirect to return
    the skb directly back to the netif it comes from, i.e., xnet is
    false in skb_scrub_packet(), and then ipvs_property is preserved
    and SNAT is skipped in the rx path.
    
    ipvs_property has been already cleared when netns is changed in
    commit 2b5ec1a5f973 ("netfilter/ipvs: clear ipvs_property flag when
    SKB net namespace changed"). This patch just clears it in spite of
    netns.
    
    Fixes: 2b5ec1a5f973 ("netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed")
    Signed-off-by: Philo Lu <lulie@xxxxxxxxxxxxxxxxx>
    Acked-by: Julian Anastasov <ja@xxxxxx>
    Link: https://patch.msgid.link/20250222033518.126087-1-lulie@xxxxxxxxxxxxxxxxx
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index f0a9ef1aeaa29..21a83e26f004b 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -5867,11 +5867,11 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet)
 	skb->offload_fwd_mark = 0;
 	skb->offload_l3_fwd_mark = 0;
 #endif
+	ipvs_reset(skb);
 
 	if (!xnet)
 		return;
 
-	ipvs_reset(skb);
 	skb->mark = 0;
 	skb_clear_tstamp(skb);
 }