netfilter: nf_reject: don't leak dst refcount for loopback packets

JIRA: https://issues.redhat.com/browse/RHEL-115630
Upstream Status: commit 91a79b7

commit 91a79b7
Author: Florian Westphal <fw@strlen.de>
Date:   Wed Aug 20 14:37:07 2025 +0200

    netfilter: nf_reject: don't leak dst refcount for loopback packets

    recent patches to add a WARN() when replacing skb dst entry found an
    old bug:

    WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline]
    WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline]
    WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234
    [..]
    Call Trace:
     nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325
     nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27
     expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline]
     ..

    This is because blamed commit forgot about loopback packets.
    Such packets already have a dst_entry attached, even at PRE_ROUTING stage.

    Instead of checking hook just check if the skb already has a route
    attached to it.

    Fixes: f53b9b0 ("netfilter: introduce support for reject at prerouting stage")
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Link: https://patch.msgid.link/20250820123707.10671-1-fw@strlen.de
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Florian Westphal <fwestpha@redhat.com>

Author: fw-strlen

net/ipv4/netfilter/nf_reject_ipv4.c

@@ -245,8 +245,7 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb,
 	if (!oth)
 		return;
 
-	if ((hook == NF_INET_PRE_ROUTING || hook == NF_INET_INGRESS) &&
-	    nf_reject_fill_skb_dst(oldskb) < 0)
+	if (!skb_dst(oldskb) && nf_reject_fill_skb_dst(oldskb) < 0)
 		return;
 
 	if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
@@ -317,8 +316,7 @@ void nf_send_unreach(struct sk_buff *skb_in, int code, int hook)
 	if (iph->frag_off & htons(IP_OFFSET))
 		return;
 
-	if ((hook == NF_INET_PRE_ROUTING || hook == NF_INET_INGRESS) &&
-	    nf_reject_fill_skb_dst(skb_in) < 0)
+	if (!skb_dst(skb_in) && nf_reject_fill_skb_dst(skb_in) < 0)
 		return;
 
 	if (skb_csum_unnecessary(skb_in) || !nf_reject_verify_csum(proto)) {

net/ipv6/netfilter/nf_reject_ipv6.c

@@ -293,7 +293,7 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,
 	fl6.fl6_sport = otcph->dest;
 	fl6.fl6_dport = otcph->source;
 
-	if (hook == NF_INET_PRE_ROUTING || hook == NF_INET_INGRESS) {
+	if (!skb_dst(oldskb)) {
 		nf_ip6_route(net, &dst, flowi6_to_flowi(&fl6), false);
 		if (!dst)
 			return;
@@ -396,8 +396,7 @@ void nf_send_unreach6(struct net *net, struct sk_buff *skb_in,
 	if (hooknum == NF_INET_LOCAL_OUT && skb_in->dev == NULL)
 		skb_in->dev = net->loopback_dev;
 
-	if ((hooknum == NF_INET_PRE_ROUTING || hooknum == NF_INET_INGRESS) &&
-	    nf_reject6_fill_skb_dst(skb_in) < 0)
+	if (!skb_dst(skb_in) && nf_reject6_fill_skb_dst(skb_in) < 0)
 		return;
 
 	icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0);