[PATCH nft] test: shell: add regression test for 'ip fwd to' stack recursion

[PATCH nft] test: shell: add regression test for 'ip fwd to' stack recursion

[Florian Westphal]

Check for:

BUG: IRQ stack guard page was hit at ffffc90000650f58 (stack is ffffc90000651000..ffffc90000659000)
RIP: 0010:nft_do_chain+0x2e/0x1580 [nf_tables]
 <IRQ>
 nft_do_chain_netdev+0x146/0x1220 [nf_tables]
 nf_hook_slow+0xaa/0x1e0
 nf_hook_egress+0x1dd/0x3c0
 __dev_queue_xmit+0x9eb/0x1b60
 nft_fwd_neigh_eval+0x40a/0x13a0 [nft_fwd_netdev]
 neigh_xmit+0x156/0x860
 nft_fwd_neigh_eval+0x40a/0x13a0 [nft_fwd_netdev]
 nft_do_chain+0x225/0x1580 [nf_tables]
 nft_do_chain_netdev+0x146/0x1220 [nf_tables]
 [..]

Signed-off-by: Florian Westphal <fw@strlen.de>
---
 tests/shell/testcases/packetpath/fwd_ip | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/tests/shell/testcases/packetpath/fwd_ip b/tests/shell/testcases/packetpath/fwd_ip
index 5494d4c8fe06..302f48afa554 100755
--- a/tests/shell/testcases/packetpath/fwd_ip
+++ b/tests/shell/testcases/packetpath/fwd_ip
@@ -152,4 +152,21 @@ echo "Egress ruleset loaded"
 ip netns exec "$ns3" $NFT "reset counter inet rxt rxc"
 ping_and_check
 
+ip netns exec "$ns2" $NFT -f /dev/stdin <<"EOF"
+flush ruleset
+table netdev fwd_test {
+	chain egress_veth3 {
+		type filter hook egress device veth3 priority 0; policy accept;
+		# Forward ICMP packets to 10.0.3.1 via neigh
+		ip protocol icmp counter fwd ip to 10.0.3.1 device "veth3"
+	}
+}
+EOF
+[ $? -ne 0 ] && exit 1
+
+# old kernels that lack
+# 1d47b55b36d2 ("netfilter: nft_fwd_netdev: use recursion counter in neigh egress path")
+# can crash here.
+ip netns exec "$ns1" ping -c 1 -W 1 10.0.3.1
+
 exit 0
-- 
2.54.0