* [PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path
@ 2026-11-03 12:56 Fernando Fernandez Mancera
2026-11-04 0:59 ` kernel test robot
2026-11-04 5:46 ` kernel test robot
0 siblings, 2 replies; 4+ messages in thread
From: Fernando Fernandez Mancera @ 2026-11-03 12:56 UTC (permalink / raw)
To: netfilter-devel; +Cc: coreteam, phil, fw, pablo, Fernando Fernandez Mancera
Packets generated at synproxy_send_tcp() and synproxy_send_tcp_ipv6()
are handled by ip_local_out() and ip6_local_out) which traverse
LOCAL_OUT and POST_ROUTING. As SYNPROXY hooks are registered on
POST_ROUTING, a payload mangling rule at OUTPUT with priority raw can
rewrite the generated ACK to SYN|ACK before conntrack sees it.
This leaves the conntrack state in SYN_RECV state and synproxy sends two
more ACKs repeating the cycle until the IRQ stack guard page is hit:
BUG: IRQ stack guard page was hit
Oops: stack guard page: 0000 [#1] SMP NOPTI
synproxy_send_tcp
ipv4_synproxy_hook
nf_hook_slow
ip_output
ipv4_synproxy_hook
...
Fix this by applying the per-CPU xmit recursion limit. Note that this
cannot be triggered with iptables as it is not possible to modify the
TCP flags from raw priority.
Fixes: ad49d86e07a4 ("netfilter: nf_tables: Add synproxy support")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
---
net/netfilter/nf_synproxy_core.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
index 401ce5a13f3f..9dd681596c70 100644
--- a/net/netfilter/nf_synproxy_core.c
+++ b/net/netfilter/nf_synproxy_core.c
@@ -21,6 +21,7 @@
#include <net/netfilter/nf_conntrack_synproxy.h>
#include <net/netfilter/nf_conntrack_zones.h>
#include <net/netfilter/nf_synproxy.h>
+#include <net/netfilter/nf_recursion.h>
static DEFINE_MUTEX(synproxy_mutex);
@@ -439,7 +440,16 @@ synproxy_send_tcp(struct net *net,
nf_conntrack_get(nfct);
}
+ local_bh_disable();
+ if (nf_dev_xmit_recursion()) {
+ local_bh_enable();
+ goto free_nskb;
+ }
+
+ nf_dev_xmit_recursion_inc();
ip_local_out(net, nskb->sk, nskb);
+ nf_dev_xmit_recursion_dec();
+ local_bh_enable();
return;
free_nskb:
@@ -858,7 +868,16 @@ synproxy_send_tcp_ipv6(struct net *net,
nf_conntrack_get(nfct);
}
+ local_bh_disable();
+ if (nf_dev_xmit_recursion()) {
+ local_bh_enable();
+ goto free_nskb;
+ }
+
+ nf_dev_xmit_recursion_inc();
ip6_local_out(net, nskb->sk, nskb);
+ nf_dev_xmit_recursion_dec();
+ local_bh_enable();
return;
free_nskb:
--
2.56.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path
2026-11-03 12:56 [PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path Fernando Fernandez Mancera
@ 2026-11-04 0:59 ` kernel test robot
2026-11-04 10:00 ` Fernando Fernandez Mancera
2026-11-04 5:46 ` kernel test robot
1 sibling, 1 reply; 4+ messages in thread
From: kernel test robot @ 2026-11-04 0:59 UTC (permalink / raw)
To: Fernando Fernandez Mancera, netfilter-devel
Cc: llvm, oe-kbuild-all, coreteam, phil, fw, pablo,
Fernando Fernandez Mancera
Hi Fernando,
kernel test robot noticed the following build errors:
[auto build test ERROR on netfilter-nf/main]
url: https://github.com/intel-lab-lkp/linux/commits/Fernando-Fernandez-Mancera/netfilter-synproxy-prevent-unbounded-recursion-in-transmit-path/20261103-135638
base: https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git main
patch link: https://lore.kernel.org/r/20261103125638.4667-1-fmancera%40suse.de
patch subject: [PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path
config: s390-defconfig (https://download.01.org/0day-ci/archive/20261104/202611040824.Zozbyqd6-lkp@intel.com/config)
compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261104/202611040824.Zozbyqd6-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202611040824.Zozbyqd6-lkp@intel.com/
All errors (new ones prefixed by >>):
>> net/netfilter/nf_synproxy_core.c:24:10: fatal error: 'net/netfilter/nf_recursion.h' file not found
24 | #include <net/netfilter/nf_recursion.h>
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
vim +24 net/netfilter/nf_synproxy_core.c
16
17 #include <net/netfilter/nf_conntrack.h>
18 #include <net/netfilter/nf_conntrack_ecache.h>
19 #include <net/netfilter/nf_conntrack_extend.h>
20 #include <net/netfilter/nf_conntrack_seqadj.h>
21 #include <net/netfilter/nf_conntrack_synproxy.h>
22 #include <net/netfilter/nf_conntrack_zones.h>
23 #include <net/netfilter/nf_synproxy.h>
> 24 #include <net/netfilter/nf_recursion.h>
25
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path
2026-11-04 0:59 ` kernel test robot
@ 2026-11-04 10:00 ` Fernando Fernandez Mancera
0 siblings, 0 replies; 4+ messages in thread
From: Fernando Fernandez Mancera @ 2026-11-04 10:00 UTC (permalink / raw)
To: kernel test robot, netfilter-devel
Cc: llvm, oe-kbuild-all, coreteam, phil, fw, pablo
On 11/4/26 1:59 AM, kernel test robot wrote:
> Hi Fernando,
>
> kernel test robot noticed the following build errors:
>
> [auto build test ERROR on netfilter-nf/main]
>
> url: https://github.com/intel-lab-lkp/linux/commits/Fernando-Fernandez-Mancera/netfilter-synproxy-prevent-unbounded-recursion-in-transmit-path/20261103-135638
> base: https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git main
> patch link: https://lore.kernel.org/r/20261103125638.4667-1-fmancera%40suse.de
> patch subject: [PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path
> config: s390-defconfig (https://download.01.org/0day-ci/archive/20261104/202611040824.Zozbyqd6-lkp@intel.com/config)
> compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff)
> reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261104/202611040824.Zozbyqd6-lkp@intel.com/reproduce)
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202611040824.Zozbyqd6-lkp@intel.com/
>
> All errors (new ones prefixed by >>):
>
>>> net/netfilter/nf_synproxy_core.c:24:10: fatal error: 'net/netfilter/nf_recursion.h' file not found
> 24 | #include <net/netfilter/nf_recursion.h>
> | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 1 error generated.
>
>
> vim +24 net/netfilter/nf_synproxy_core.c
>
> 16
> 17 #include <net/netfilter/nf_conntrack.h>
> 18 #include <net/netfilter/nf_conntrack_ecache.h>
> 19 #include <net/netfilter/nf_conntrack_extend.h>
> 20 #include <net/netfilter/nf_conntrack_seqadj.h>
> 21 #include <net/netfilter/nf_conntrack_synproxy.h>
> 22 #include <net/netfilter/nf_conntrack_zones.h>
> 23 #include <net/netfilter/nf_synproxy.h>
> > 24 #include <net/netfilter/nf_recursion.h>
> 25
>
> --
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki
The patch depends on
https://lore.kernel.org/netfilter-devel/20261104090224.750548-2-pablo@netfilter.org/
So the robot errors are not very relevant. We can ignore them. The patch
was tested with that commit as a base.
Thanks,
Fernando.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path
2026-11-03 12:56 [PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path Fernando Fernandez Mancera
2026-11-04 0:59 ` kernel test robot
@ 2026-11-04 5:46 ` kernel test robot
1 sibling, 0 replies; 4+ messages in thread
From: kernel test robot @ 2026-11-04 5:46 UTC (permalink / raw)
To: Fernando Fernandez Mancera, netfilter-devel
Cc: oe-kbuild-all, coreteam, phil, fw, pablo,
Fernando Fernandez Mancera
Hi Fernando,
kernel test robot noticed the following build errors:
[auto build test ERROR on netfilter-nf/main]
url: https://github.com/intel-lab-lkp/linux/commits/Fernando-Fernandez-Mancera/netfilter-synproxy-prevent-unbounded-recursion-in-transmit-path/20261103-135638
base: https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git main
patch link: https://lore.kernel.org/r/20261103125638.4667-1-fmancera%40suse.de
patch subject: [PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path
config: sh-allyesconfig (https://download.01.org/0day-ci/archive/20261104/202611041332.BDDaWwCF-lkp@intel.com/config)
compiler: sh4-linux-gcc (GCC) 16.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261104/202611041332.BDDaWwCF-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202611041332.BDDaWwCF-lkp@intel.com/
All errors (new ones prefixed by >>):
>> net/netfilter/nf_synproxy_core.c:24:10: fatal error: net/netfilter/nf_recursion.h: No such file or directory
24 | #include <net/netfilter/nf_recursion.h>
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
compilation terminated.
vim +24 net/netfilter/nf_synproxy_core.c
16
17 #include <net/netfilter/nf_conntrack.h>
18 #include <net/netfilter/nf_conntrack_ecache.h>
19 #include <net/netfilter/nf_conntrack_extend.h>
20 #include <net/netfilter/nf_conntrack_seqadj.h>
21 #include <net/netfilter/nf_conntrack_synproxy.h>
22 #include <net/netfilter/nf_conntrack_zones.h>
23 #include <net/netfilter/nf_synproxy.h>
> 24 #include <net/netfilter/nf_recursion.h>
25
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-11-04 10:02 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-03 12:56 [PATCH nf] netfilter: synproxy: prevent unbounded recursion in transmit path Fernando Fernandez Mancera
2026-11-04 0:59 ` kernel test robot
2026-11-04 10:00 ` Fernando Fernandez Mancera
2026-11-04 5:46 ` kernel test robot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.