blob: 6a3e666073c88b3c52a5ecd494e97894b502b03d [file] [log] [blame]
From ab7d2e828b2e44afd86df3597d98bad14855efc3 Mon Sep 17 00:00:00 2001
From: Marco Oliverio <>
Date: Mon, 2 Dec 2019 19:54:30 +0100
Subject: [PATCH] netfilter: nf_queue: enqueue skbs with NULL dst
commit 0b9173f4688dfa7c5d723426be1d979c24ce3d51 upstream.
Bridge packets that are forwarded have skb->dst == NULL and get
dropped by the check introduced by
b60a77386b1d4868f72f6353d35dabe5fbe981f2 (net: make skb_dst_force
return true when dst is refcounted).
To fix this we check skb_dst() before skb_dst_force(), so we don't
drop skb packet with dst == NULL. This holds also for skb at the
PRE_ROUTING hook so we remove the second check.
Fixes: b60a77386b1d ("net: make skb_dst_force return true when dst is refcounted")
Signed-off-by: Marco Oliverio <>
Signed-off-by: Rocco Folino <>
Acked-by: Florian Westphal <>
Signed-off-by: Pablo Neira Ayuso <>
Signed-off-by: Paul Gortmaker <>
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 2c440015ff0c..3d8aca9ac06d 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -190,7 +190,7 @@ static int __nf_queue(struct sk_buff *skb, const struct nf_hook_state *state,
goto err;
- if (!skb_dst_force(skb) && state->hook != NF_INET_PRE_ROUTING) {
+ if (skb_dst(skb) && !skb_dst_force(skb)) {
status = -ENETDOWN;
goto err;