IPIP tunneling support does not result in crossing a netns, therefore, adopt the more conservative variant of skb_scrub_packet() by specifying !xnet, keep the existing skb mark in place. Fixes: d30301ba4b07 ("netfilter: flowtable: Add IPIP tx sw acceleration") Signed-off-by: Pablo Neira Ayuso --- @Lorenzo: Do you remember the reason why this is scrubbing as crossing netns? There is a LLM report that is flagging this as an issue when interacting with other subsystem, eg. packets was marked. At least in the tunnel driver I can see this is conditional. net/netfilter/nf_flow_table_ip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_flow_table_ip.c b/net/netfilter/nf_flow_table_ip.c index 19cafae748ab..78bba416dd5b 100644 --- a/net/netfilter/nf_flow_table_ip.c +++ b/net/netfilter/nf_flow_table_ip.c @@ -630,7 +630,7 @@ static int nf_flow_tunnel_ip_push(struct net *net, struct sk_buff *skb, if (err) return err; - skb_scrub_packet(skb, true); + skb_scrub_packet(skb, false); skb_clear_hash_if_not_l4(skb); /* Push down and install the IP header. */ @@ -699,7 +699,7 @@ static int nf_flow_tunnel_ip6_push(struct net *net, struct sk_buff *skb, if (err) return err; - skb_scrub_packet(skb, true); + skb_scrub_packet(skb, false); mtu = dst_mtu(dst) - sizeof(*ip6h); mtu = max(mtu, IPV6_MIN_MTU); skb_dst_update_pmtu_no_confirm(skb, mtu); -- 2.47.3