On Wed, Jul 01, 2026 at 01:01:58PM +0200, Pablo Neira Ayuso wrote:

On Wed, Jul 01, 2026 at 08:36:11AM +0200, Florian Westphal wrote:

quoted

Florian Westphal [off-list ref] wrote:

quoted

From: Pablo Neira Ayuso <pablo@netfilter.org>

tc ingress and openvswitch do not guarantee routing information to be
available. These subsystems use the conntrack helper infrastructure, and
the SIP helper relies on the skb_dst() to be present if
sip_external_media is set to 1 (which is disabled by default as a module
parameter).

The sashiko drive-by appears real, I submitted a patch for it.
Its not a regression added by this patch but a unrelated issue.

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20260701062922.9660-1-fw@strlen.de/

Is skb_ensure_writable() bogus here?

As you said, skb is already linearized. As for clones, they should
only happen in br_netfilter? In such case, it should be br_netfilter
that should be audited not to pass cloned skbuffs before calling the
inet hooks.

Forget this, this skb_ensure_writable() is really needed here.