[PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path

[PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path

[Fernando Fernandez Mancera]

Packets generated at synproxy_send_tcp() and synproxy_send_tcp_ipv6()
are handled by ip_local_out() and ip6_local_out) which traverse
LOCAL_OUT and POST_ROUTING. As SYNPROXY hooks are registered on
POST_ROUTING, a payload mangling rule at OUTPUT with priority raw can
rewrite the generated ACK to SYN|ACK before conntrack sees it.

This leaves the conntrack state in SYN_RECV state and synproxy sends two
more ACKs repeating the cycle until the IRQ stack guard page is hit:

  BUG: IRQ stack guard page was hit
  Oops: stack guard page: 0000 [#1] SMP NOPTI
   synproxy_send_tcp
   ipv4_synproxy_hook
   nf_hook_slow
   ip_output
   ipv4_synproxy_hook
   ...

Fix this by applying the per-CPU xmit recursion limit. Note that this
cannot be triggered with iptables as it is not possible to modify the
TCP flags from raw priority.

Fixes: ad49d86e07a4 ("netfilter: nf_tables: Add synproxy support")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
---
 net/netfilter/nf_synproxy_core.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index 401ce5a13f3f..9dd681596c70 100644
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -21,6 +21,7 @@
 #include <net/netfilter/nf_conntrack_synproxy.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_synproxy.h>
+#include <net/netfilter/nf_recursion.h>
 
 static DEFINE_MUTEX(synproxy_mutex);
 
@@ -439,7 +440,16 @@ synproxy_send_tcp(struct net *net,
 		nf_conntrack_get(nfct);
 	}
 
+	local_bh_disable();
+	if (nf_dev_xmit_recursion()) {
+		local_bh_enable();
+		goto free_nskb;
+	}
+
+	nf_dev_xmit_recursion_inc();
 	ip_local_out(net, nskb->sk, nskb);
+	nf_dev_xmit_recursion_dec();
+	local_bh_enable();
 	return;
 
 free_nskb:
@@ -858,7 +868,16 @@ synproxy_send_tcp_ipv6(struct net *net,
 		nf_conntrack_get(nfct);
 	}
 
+	local_bh_disable();
+	if (nf_dev_xmit_recursion()) {
+		local_bh_enable();
+		goto free_nskb;
+	}
+
+	nf_dev_xmit_recursion_inc();
 	ip6_local_out(net, nskb->sk, nskb);
+	nf_dev_xmit_recursion_dec();
+	local_bh_enable();
 	return;
 
 free_nskb:
-- 
2.56.0

Re: [PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path

[kernel test robot]

Hi Fernando,

kernel test robot noticed the following build errors:

[auto build test ERROR on netfilter-nf/main]

url:    https://github.com/intel-lab-lkp/linux/commits/Fernando-Fernandez-Mancera/netfilter-synproxy-prevent-unbounded-recursion-in-transmit-path/20261103-135638
base:   https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git main
patch link:    https://lore.kernel.org/r/20261103125638.4667-1-fmancera%40suse.de
patch subject: [PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path
config: s390-defconfig (https://download.01.org/0day-ci/archive/20261104/202611040824.Zozbyqd6-lkp@intel.com/config)
compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261104/202611040824.Zozbyqd6-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202611040824.Zozbyqd6-lkp@intel.com/

All errors (new ones prefixed by >>):

>> net/netfilter/nf_synproxy_core.c:24:10: fatal error: 'net/netfilter/nf_recursion.h' file not found
      24 | #include <net/netfilter/nf_recursion.h>
         |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   1 error generated.


vim +24 net/netfilter/nf_synproxy_core.c

    16	
    17	#include <net/netfilter/nf_conntrack.h>
    18	#include <net/netfilter/nf_conntrack_ecache.h>
    19	#include <net/netfilter/nf_conntrack_extend.h>
    20	#include <net/netfilter/nf_conntrack_seqadj.h>
    21	#include <net/netfilter/nf_conntrack_synproxy.h>
    22	#include <net/netfilter/nf_conntrack_zones.h>
    23	#include <net/netfilter/nf_synproxy.h>
  > 24	#include <net/netfilter/nf_recursion.h>
    25	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path

[kernel test robot]

Hi Fernando,

kernel test robot noticed the following build errors:

[auto build test ERROR on netfilter-nf/main]

url:    https://github.com/intel-lab-lkp/linux/commits/Fernando-Fernandez-Mancera/netfilter-synproxy-prevent-unbounded-recursion-in-transmit-path/20261103-135638
base:   https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git main
patch link:    https://lore.kernel.org/r/20261103125638.4667-1-fmancera%40suse.de
patch subject: [PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path
config: sh-allyesconfig (https://download.01.org/0day-ci/archive/20261104/202611041332.BDDaWwCF-lkp@intel.com/config)
compiler: sh4-linux-gcc (GCC) 16.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261104/202611041332.BDDaWwCF-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202611041332.BDDaWwCF-lkp@intel.com/

All errors (new ones prefixed by >>):

>> net/netfilter/nf_synproxy_core.c:24:10: fatal error: net/netfilter/nf_recursion.h: No such file or directory
      24 | #include <net/netfilter/nf_recursion.h>
         |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   compilation terminated.


vim +24 net/netfilter/nf_synproxy_core.c

    16	
    17	#include <net/netfilter/nf_conntrack.h>
    18	#include <net/netfilter/nf_conntrack_ecache.h>
    19	#include <net/netfilter/nf_conntrack_extend.h>
    20	#include <net/netfilter/nf_conntrack_seqadj.h>
    21	#include <net/netfilter/nf_conntrack_synproxy.h>
    22	#include <net/netfilter/nf_conntrack_zones.h>
    23	#include <net/netfilter/nf_synproxy.h>
  > 24	#include <net/netfilter/nf_recursion.h>
    25	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path

[Fernando Fernandez Mancera]

On 11/4/26 1:59 AM, kernel test robot wrote:
> Hi Fernando,
> 
> kernel test robot noticed the following build errors:
> 
> [auto build test ERROR on netfilter-nf/main]
> 
> url:    https://github.com/intel-lab-lkp/linux/commits/Fernando-Fernandez-Mancera/netfilter-synproxy-prevent-unbounded-recursion-in-transmit-path/20261103-135638
> base:   https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git main
> patch link:    https://lore.kernel.org/r/20261103125638.4667-1-fmancera%40suse.de
> patch subject: [PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path
> config: s390-defconfig (https://download.01.org/0day-ci/archive/20261104/202611040824.Zozbyqd6-lkp@intel.com/config)
> compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff)
> reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261104/202611040824.Zozbyqd6-lkp@intel.com/reproduce)
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202611040824.Zozbyqd6-lkp@intel.com/
> 
> All errors (new ones prefixed by >>):
> 
>>> net/netfilter/nf_synproxy_core.c:24:10: fatal error: 'net/netfilter/nf_recursion.h' file not found
>        24 | #include <net/netfilter/nf_recursion.h>
>           |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>     1 error generated.
> 
> 
> vim +24 net/netfilter/nf_synproxy_core.c
> 
>      16	
>      17	#include <net/netfilter/nf_conntrack.h>
>      18	#include <net/netfilter/nf_conntrack_ecache.h>
>      19	#include <net/netfilter/nf_conntrack_extend.h>
>      20	#include <net/netfilter/nf_conntrack_seqadj.h>
>      21	#include <net/netfilter/nf_conntrack_synproxy.h>
>      22	#include <net/netfilter/nf_conntrack_zones.h>
>      23	#include <net/netfilter/nf_synproxy.h>
>    > 24	#include <net/netfilter/nf_recursion.h>
>      25	
> 
> --
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki

The patch depends on 
https://lore.kernel.org/netfilter-devel/20261104090224.750548-2-pablo@netfilter.org/

So the robot errors are not very relevant. We can ignore them. The patch 
was tested with that commit as a base.

Thanks,
Fernando.