Re: [PATCH net] netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

On Tue, Aug 04, 2026 at 09:33:28AM +0000, Eric Dumazet wrote:
> Incoming skbs passing through netfilter flowtable offload hooks (or XFRM
> offload path) might already carry a ref-counted dst_entry assigned during
> earlier RX or routing steps.
> 
> Calling skb_dst_set_noref() when skb already holds a ref-counted dst
> overwrites skb->_skb_refdst, leaking the previous dst_entry reference
> count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in
> skb_dst_check_unset():
> 
>   WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170
>   WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234
>   WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864
> 
> Drop any existing dst_entry reference with skb_dst_drop(skb) before
> setting the non-referenced flowtable destination.
> 
> Fixes: 2a79fd3908ac ("netfilter: nf_flow_table: attach dst to skbs")
> Reported-by: [email protected]
> Closes: https://lore.kernel.org/netdev/[email protected]/T/#u
> Signed-off-by: Eric Dumazet <[email protected]>

Reviewed-by: Pablo Neira Ayuso <[email protected]>