Re: [PATCH nf v3] netfilter: nft_reject: prevent unbounded recursion in output hooks

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Oct 22, 2026 at 08:32:50PM +0200, Fernando Fernandez Mancera wrote:
> On 9/24/26 10:13 PM, Fernando Fernandez Mancera wrote:
> > nftables payload-mangling rules can rewrite packet contents (such as TCP
> > flags) before they are evaluated by reject targets. This defeats the
> > content-based loop guards, allowing unbounded hook recursion that leads
> > to kernel stack exhaustion and panics.
> > 
> > Fix this by extracting the per-CPU xmit recursion limit previously used
> > by the netdev duplication/forwarding paths into a shared header, and
> > apply it to the inet and inet6 reject transmit functions. It disables BH
> > while transmitting the skb to address a possible migration to different
> > CPU leading to imbalanced decrementation of the recursion counters.
> > 
> > Note that the dev_queue_xmit() path used when CONFIG_BRIDGE_NETFILTER is
> > enabled does not require this recursion guard. In that scenario, the
> > generated reset packet is transmitted directly at Layer 2. Because the
> > packet egresses from a different hook, it cannot synchronously loop. In
> > addition nf_send_unreach() and nf_send_unreach6() are safe as the ICMP
> > transmit functions are protected against recursion by the
> > icmp_xmit_lock() and icmpv6_xmit_lock() guards.
> > 
> > Reported-by: Yu Junzhe <junzheyu1@gmail.com>
> > Closes: https://lore.kernel.org/netfilter-devel/20260921061320.543-1-junzheyu1@gmail.com/
> > Fixes: bee11dc78fc8 ("netfilter: nft_reject: support for IPv6 and TCP reset")
> > Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
> > ---
> > v3: fixed build robot errors due to the struct member being guarded by
> > CONFIG_NF_DUP_NETDEV instead of CONFIG_NETFILTER and renamed the struct
> > member too.
> 
> Is there something missing for this patch? It would be nice if we can get
> this in the next nf.git since it was discover by a real user (or it looks
> like so).

I will include this in the next nf.git batch.