* [PATCH nf v3] netfilter: nft_reject: prevent unbounded recursion in output hooks
@ 2026-09-24 20:13 Fernando Fernandez Mancera
2026-10-22 18:32 ` Fernando Fernandez Mancera
0 siblings, 1 reply; 3+ messages in thread
From: Fernando Fernandez Mancera @ 2026-09-24 20:13 UTC (permalink / raw)
To: netfilter-devel
Cc: coreteam, pablo, fw, phil, Fernando Fernandez Mancera, Yu Junzhe
nftables payload-mangling rules can rewrite packet contents (such as TCP
flags) before they are evaluated by reject targets. This defeats the
content-based loop guards, allowing unbounded hook recursion that leads
to kernel stack exhaustion and panics.
Fix this by extracting the per-CPU xmit recursion limit previously used
by the netdev duplication/forwarding paths into a shared header, and
apply it to the inet and inet6 reject transmit functions. It disables BH
while transmitting the skb to address a possible migration to different
CPU leading to imbalanced decrementation of the recursion counters.
Note that the dev_queue_xmit() path used when CONFIG_BRIDGE_NETFILTER is
enabled does not require this recursion guard. In that scenario, the
generated reset packet is transmitted directly at Layer 2. Because the
packet egresses from a different hook, it cannot synchronously loop. In
addition nf_send_unreach() and nf_send_unreach6() are safe as the ICMP
transmit functions are protected against recursion by the
icmp_xmit_lock() and icmpv6_xmit_lock() guards.
Reported-by: Yu Junzhe <junzheyu1@gmail.com>
Closes: https://lore.kernel.org/netfilter-devel/20260921061320.543-1-junzheyu1@gmail.com/
Fixes: bee11dc78fc8 ("netfilter: nft_reject: support for IPv6 and TCP reset")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
---
v3: fixed build robot errors due to the struct member being guarded by
CONFIG_NF_DUP_NETDEV instead of CONFIG_NETFILTER and renamed the struct
member too.
---
include/linux/netdevice_xmit.h | 4 +--
include/net/netfilter/nf_dup_netdev.h | 35 ----------------------
include/net/netfilter/nf_recursion.h | 42 +++++++++++++++++++++++++++
net/ipv4/netfilter/nf_reject_ipv4.c | 12 ++++++++
net/ipv6/netfilter/nf_reject_ipv6.c | 13 +++++++++
net/netfilter/nf_dup_netdev.c | 1 +
net/netfilter/nft_fwd_netdev.c | 1 +
7 files changed, 71 insertions(+), 37 deletions(-)
create mode 100644 include/net/netfilter/nf_recursion.h
diff --git a/include/linux/netdevice_xmit.h b/include/linux/netdevice_xmit.h
index cc232508e695..286ae5a6101e 100644
--- a/include/linux/netdevice_xmit.h
+++ b/include/linux/netdevice_xmit.h
@@ -18,8 +18,8 @@ struct netdev_xmit {
u8 sched_mirred_nest;
struct net_device *sched_mirred_dev[MIRRED_NEST_LIMIT];
#endif
-#if IS_ENABLED(CONFIG_NF_DUP_NETDEV)
- u8 nf_dup_skb_recursion;
+#if IS_ENABLED(CONFIG_NETFILTER)
+ u8 nf_xmit_skb_recursion;
#endif
};
diff --git a/include/net/netfilter/nf_dup_netdev.h b/include/net/netfilter/nf_dup_netdev.h
index f6b05bd80c3f..a39411264614 100644
--- a/include/net/netfilter/nf_dup_netdev.h
+++ b/include/net/netfilter/nf_dup_netdev.h
@@ -9,41 +9,6 @@
void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif);
void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif);
-#define NF_RECURSION_LIMIT 2
-
-#ifndef CONFIG_PREEMPT_RT
-static inline bool nf_dev_xmit_recursion(void)
-{
- return unlikely(__this_cpu_read(softnet_data.xmit.nf_dup_skb_recursion) >
- NF_RECURSION_LIMIT);
-}
-
-static inline void nf_dev_xmit_recursion_inc(void)
-{
- __this_cpu_inc(softnet_data.xmit.nf_dup_skb_recursion);
-}
-
-static inline void nf_dev_xmit_recursion_dec(void)
-{
- __this_cpu_dec(softnet_data.xmit.nf_dup_skb_recursion);
-}
-#else
-static inline bool nf_dev_xmit_recursion(void)
-{
- return unlikely(current->net_xmit.nf_dup_skb_recursion > NF_RECURSION_LIMIT);
-}
-
-static inline void nf_dev_xmit_recursion_inc(void)
-{
- current->net_xmit.nf_dup_skb_recursion++;
-}
-
-static inline void nf_dev_xmit_recursion_dec(void)
-{
- current->net_xmit.nf_dup_skb_recursion--;
-}
-#endif
-
struct nft_offload_ctx;
struct nft_flow_rule;
diff --git a/include/net/netfilter/nf_recursion.h b/include/net/netfilter/nf_recursion.h
new file mode 100644
index 000000000000..1ac65f7793f1
--- /dev/null
+++ b/include/net/netfilter/nf_recursion.h
@@ -0,0 +1,42 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef _NF_RECURSION_H_
+#define _NF_RECURSION_H_
+
+#include <linux/netdevice.h>
+
+#define NF_RECURSION_LIMIT 2
+
+#ifndef CONFIG_PREEMPT_RT
+static inline bool nf_dev_xmit_recursion(void)
+{
+ return unlikely(__this_cpu_read(softnet_data.xmit.nf_xmit_skb_recursion) >
+ NF_RECURSION_LIMIT);
+}
+
+static inline void nf_dev_xmit_recursion_inc(void)
+{
+ __this_cpu_inc(softnet_data.xmit.nf_xmit_skb_recursion);
+}
+
+static inline void nf_dev_xmit_recursion_dec(void)
+{
+ __this_cpu_dec(softnet_data.xmit.nf_xmit_skb_recursion);
+}
+#else
+static inline bool nf_dev_xmit_recursion(void)
+{
+ return unlikely(current->net_xmit.nf_xmit_skb_recursion > NF_RECURSION_LIMIT);
+}
+
+static inline void nf_dev_xmit_recursion_inc(void)
+{
+ current->net_xmit.nf_xmit_skb_recursion++;
+}
+
+static inline void nf_dev_xmit_recursion_dec(void)
+{
+ current->net_xmit.nf_xmit_skb_recursion--;
+}
+#endif
+
+#endif /* _NF_RECURSION_H_ */
diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index 59ec465a9df9..3f227a094312 100644
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -10,6 +10,7 @@
#include <net/dst.h>
#include <net/dst_metadata.h>
#include <net/netfilter/ipv4/nf_reject.h>
+#include <net/netfilter/nf_recursion.h>
#include <linux/netfilter_ipv4.h>
#include <linux/netfilter_bridge.h>
@@ -336,7 +337,18 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb,
dev_queue_xmit(nskb);
} else
#endif
+ {
+ local_bh_disable();
+ if (nf_dev_xmit_recursion()) {
+ local_bh_enable();
+ goto free_nskb;
+ }
+
+ nf_dev_xmit_recursion_inc();
ip_local_out(net, nskb->sk, nskb);
+ nf_dev_xmit_recursion_dec();
+ local_bh_enable();
+ }
return;
diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
index 07cdaa10da0d..f69ddfe72030 100644
--- a/net/ipv6/netfilter/nf_reject_ipv6.c
+++ b/net/ipv6/netfilter/nf_reject_ipv6.c
@@ -10,6 +10,7 @@
#include <net/ip6_checksum.h>
#include <net/dst_metadata.h>
#include <net/netfilter/ipv6/nf_reject.h>
+#include <net/netfilter/nf_recursion.h>
#include <linux/netfilter_ipv6.h>
#include <linux/netfilter_bridge.h>
@@ -409,7 +410,19 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,
dev_queue_xmit(nskb);
} else
#endif
+ {
+ local_bh_disable();
+ if (nf_dev_xmit_recursion()) {
+ local_bh_enable();
+ kfree_skb(nskb);
+ return;
+ }
+
+ nf_dev_xmit_recursion_inc();
ip6_local_out(net, sk, nskb);
+ nf_dev_xmit_recursion_dec();
+ local_bh_enable();
+ }
}
EXPORT_SYMBOL_GPL(nf_send_reset6);
diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
index c6bd5c29bed6..918716629c15 100644
--- a/net/netfilter/nf_dup_netdev.c
+++ b/net/netfilter/nf_dup_netdev.c
@@ -12,6 +12,7 @@
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables_offload.h>
#include <net/netfilter/nf_dup_netdev.h>
+#include <net/netfilter/nf_recursion.h>
static void nf_do_netdev_egress(struct sk_buff *skb, struct net_device *dev,
enum nf_dev_hooks hook)
diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
index a48c2f765bba..7447da931a95 100644
--- a/net/netfilter/nft_fwd_netdev.c
+++ b/net/netfilter/nft_fwd_netdev.c
@@ -14,6 +14,7 @@
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables_offload.h>
#include <net/netfilter/nf_dup_netdev.h>
+#include <net/netfilter/nf_recursion.h>
#include <net/neighbour.h>
#include <net/ip.h>
--
2.55.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH nf v3] netfilter: nft_reject: prevent unbounded recursion in output hooks
2026-09-24 20:13 [PATCH nf v3] netfilter: nft_reject: prevent unbounded recursion in output hooks Fernando Fernandez Mancera
@ 2026-10-22 18:32 ` Fernando Fernandez Mancera
2026-10-22 22:06 ` Pablo Neira Ayuso
0 siblings, 1 reply; 3+ messages in thread
From: Fernando Fernandez Mancera @ 2026-10-22 18:32 UTC (permalink / raw)
To: netfilter-devel; +Cc: coreteam, pablo, fw, phil, Yu Junzhe
On 9/24/26 10:13 PM, Fernando Fernandez Mancera wrote:
> nftables payload-mangling rules can rewrite packet contents (such as TCP
> flags) before they are evaluated by reject targets. This defeats the
> content-based loop guards, allowing unbounded hook recursion that leads
> to kernel stack exhaustion and panics.
>
> Fix this by extracting the per-CPU xmit recursion limit previously used
> by the netdev duplication/forwarding paths into a shared header, and
> apply it to the inet and inet6 reject transmit functions. It disables BH
> while transmitting the skb to address a possible migration to different
> CPU leading to imbalanced decrementation of the recursion counters.
>
> Note that the dev_queue_xmit() path used when CONFIG_BRIDGE_NETFILTER is
> enabled does not require this recursion guard. In that scenario, the
> generated reset packet is transmitted directly at Layer 2. Because the
> packet egresses from a different hook, it cannot synchronously loop. In
> addition nf_send_unreach() and nf_send_unreach6() are safe as the ICMP
> transmit functions are protected against recursion by the
> icmp_xmit_lock() and icmpv6_xmit_lock() guards.
>
> Reported-by: Yu Junzhe <junzheyu1@gmail.com>
> Closes: https://lore.kernel.org/netfilter-devel/20260921061320.543-1-junzheyu1@gmail.com/
> Fixes: bee11dc78fc8 ("netfilter: nft_reject: support for IPv6 and TCP reset")
> Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
> ---
> v3: fixed build robot errors due to the struct member being guarded by
> CONFIG_NF_DUP_NETDEV instead of CONFIG_NETFILTER and renamed the struct
> member too.
Is there something missing for this patch? It would be nice if we can
get this in the next nf.git since it was discover by a real user (or it
looks like so).
> ---
> include/linux/netdevice_xmit.h | 4 +--
> include/net/netfilter/nf_dup_netdev.h | 35 ----------------------
> include/net/netfilter/nf_recursion.h | 42 +++++++++++++++++++++++++++
> net/ipv4/netfilter/nf_reject_ipv4.c | 12 ++++++++
> net/ipv6/netfilter/nf_reject_ipv6.c | 13 +++++++++
> net/netfilter/nf_dup_netdev.c | 1 +
> net/netfilter/nft_fwd_netdev.c | 1 +
> 7 files changed, 71 insertions(+), 37 deletions(-)
> create mode 100644 include/net/netfilter/nf_recursion.h
>
> diff --git a/include/linux/netdevice_xmit.h b/include/linux/netdevice_xmit.h
> index cc232508e695..286ae5a6101e 100644
> --- a/include/linux/netdevice_xmit.h
> +++ b/include/linux/netdevice_xmit.h
> @@ -18,8 +18,8 @@ struct netdev_xmit {
> u8 sched_mirred_nest;
> struct net_device *sched_mirred_dev[MIRRED_NEST_LIMIT];
> #endif
> -#if IS_ENABLED(CONFIG_NF_DUP_NETDEV)
> - u8 nf_dup_skb_recursion;
> +#if IS_ENABLED(CONFIG_NETFILTER)
> + u8 nf_xmit_skb_recursion;
> #endif
> };
>
> diff --git a/include/net/netfilter/nf_dup_netdev.h b/include/net/netfilter/nf_dup_netdev.h
> index f6b05bd80c3f..a39411264614 100644
> --- a/include/net/netfilter/nf_dup_netdev.h
> +++ b/include/net/netfilter/nf_dup_netdev.h
> @@ -9,41 +9,6 @@
> void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif);
> void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif);
>
> -#define NF_RECURSION_LIMIT 2
> -
> -#ifndef CONFIG_PREEMPT_RT
> -static inline bool nf_dev_xmit_recursion(void)
> -{
> - return unlikely(__this_cpu_read(softnet_data.xmit.nf_dup_skb_recursion) >
> - NF_RECURSION_LIMIT);
> -}
> -
> -static inline void nf_dev_xmit_recursion_inc(void)
> -{
> - __this_cpu_inc(softnet_data.xmit.nf_dup_skb_recursion);
> -}
> -
> -static inline void nf_dev_xmit_recursion_dec(void)
> -{
> - __this_cpu_dec(softnet_data.xmit.nf_dup_skb_recursion);
> -}
> -#else
> -static inline bool nf_dev_xmit_recursion(void)
> -{
> - return unlikely(current->net_xmit.nf_dup_skb_recursion > NF_RECURSION_LIMIT);
> -}
> -
> -static inline void nf_dev_xmit_recursion_inc(void)
> -{
> - current->net_xmit.nf_dup_skb_recursion++;
> -}
> -
> -static inline void nf_dev_xmit_recursion_dec(void)
> -{
> - current->net_xmit.nf_dup_skb_recursion--;
> -}
> -#endif
> -
> struct nft_offload_ctx;
> struct nft_flow_rule;
>
> diff --git a/include/net/netfilter/nf_recursion.h b/include/net/netfilter/nf_recursion.h
> new file mode 100644
> index 000000000000..1ac65f7793f1
> --- /dev/null
> +++ b/include/net/netfilter/nf_recursion.h
> @@ -0,0 +1,42 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +#ifndef _NF_RECURSION_H_
> +#define _NF_RECURSION_H_
> +
> +#include <linux/netdevice.h>
> +
> +#define NF_RECURSION_LIMIT 2
> +
> +#ifndef CONFIG_PREEMPT_RT
> +static inline bool nf_dev_xmit_recursion(void)
> +{
> + return unlikely(__this_cpu_read(softnet_data.xmit.nf_xmit_skb_recursion) >
> + NF_RECURSION_LIMIT);
> +}
> +
> +static inline void nf_dev_xmit_recursion_inc(void)
> +{
> + __this_cpu_inc(softnet_data.xmit.nf_xmit_skb_recursion);
> +}
> +
> +static inline void nf_dev_xmit_recursion_dec(void)
> +{
> + __this_cpu_dec(softnet_data.xmit.nf_xmit_skb_recursion);
> +}
> +#else
> +static inline bool nf_dev_xmit_recursion(void)
> +{
> + return unlikely(current->net_xmit.nf_xmit_skb_recursion > NF_RECURSION_LIMIT);
> +}
> +
> +static inline void nf_dev_xmit_recursion_inc(void)
> +{
> + current->net_xmit.nf_xmit_skb_recursion++;
> +}
> +
> +static inline void nf_dev_xmit_recursion_dec(void)
> +{
> + current->net_xmit.nf_xmit_skb_recursion--;
> +}
> +#endif
> +
> +#endif /* _NF_RECURSION_H_ */
> diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
> index 59ec465a9df9..3f227a094312 100644
> --- a/net/ipv4/netfilter/nf_reject_ipv4.c
> +++ b/net/ipv4/netfilter/nf_reject_ipv4.c
> @@ -10,6 +10,7 @@
> #include <net/dst.h>
> #include <net/dst_metadata.h>
> #include <net/netfilter/ipv4/nf_reject.h>
> +#include <net/netfilter/nf_recursion.h>
> #include <linux/netfilter_ipv4.h>
> #include <linux/netfilter_bridge.h>
>
> @@ -336,7 +337,18 @@ void nf_send_reset(struct net *net, struct sock *sk, struct sk_buff *oldskb,
> dev_queue_xmit(nskb);
> } else
> #endif
> + {
> + local_bh_disable();
> + if (nf_dev_xmit_recursion()) {
> + local_bh_enable();
> + goto free_nskb;
> + }
> +
> + nf_dev_xmit_recursion_inc();
> ip_local_out(net, nskb->sk, nskb);
> + nf_dev_xmit_recursion_dec();
> + local_bh_enable();
> + }
>
> return;
>
> diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c
> index 07cdaa10da0d..f69ddfe72030 100644
> --- a/net/ipv6/netfilter/nf_reject_ipv6.c
> +++ b/net/ipv6/netfilter/nf_reject_ipv6.c
> @@ -10,6 +10,7 @@
> #include <net/ip6_checksum.h>
> #include <net/dst_metadata.h>
> #include <net/netfilter/ipv6/nf_reject.h>
> +#include <net/netfilter/nf_recursion.h>
> #include <linux/netfilter_ipv6.h>
> #include <linux/netfilter_bridge.h>
>
> @@ -409,7 +410,19 @@ void nf_send_reset6(struct net *net, struct sock *sk, struct sk_buff *oldskb,
> dev_queue_xmit(nskb);
> } else
> #endif
> + {
> + local_bh_disable();
> + if (nf_dev_xmit_recursion()) {
> + local_bh_enable();
> + kfree_skb(nskb);
> + return;
> + }
> +
> + nf_dev_xmit_recursion_inc();
> ip6_local_out(net, sk, nskb);
> + nf_dev_xmit_recursion_dec();
> + local_bh_enable();
> + }
> }
> EXPORT_SYMBOL_GPL(nf_send_reset6);
>
> diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
> index c6bd5c29bed6..918716629c15 100644
> --- a/net/netfilter/nf_dup_netdev.c
> +++ b/net/netfilter/nf_dup_netdev.c
> @@ -12,6 +12,7 @@
> #include <net/netfilter/nf_tables.h>
> #include <net/netfilter/nf_tables_offload.h>
> #include <net/netfilter/nf_dup_netdev.h>
> +#include <net/netfilter/nf_recursion.h>
>
> static void nf_do_netdev_egress(struct sk_buff *skb, struct net_device *dev,
> enum nf_dev_hooks hook)
> diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
> index a48c2f765bba..7447da931a95 100644
> --- a/net/netfilter/nft_fwd_netdev.c
> +++ b/net/netfilter/nft_fwd_netdev.c
> @@ -14,6 +14,7 @@
> #include <net/netfilter/nf_tables.h>
> #include <net/netfilter/nf_tables_offload.h>
> #include <net/netfilter/nf_dup_netdev.h>
> +#include <net/netfilter/nf_recursion.h>
> #include <net/neighbour.h>
> #include <net/ip.h>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH nf v3] netfilter: nft_reject: prevent unbounded recursion in output hooks
2026-10-22 18:32 ` Fernando Fernandez Mancera
@ 2026-10-22 22:06 ` Pablo Neira Ayuso
0 siblings, 0 replies; 3+ messages in thread
From: Pablo Neira Ayuso @ 2026-10-22 22:06 UTC (permalink / raw)
To: Fernando Fernandez Mancera; +Cc: netfilter-devel, coreteam, fw, phil, Yu Junzhe
On Thu, Oct 22, 2026 at 08:32:50PM +0200, Fernando Fernandez Mancera wrote:
> On 9/24/26 10:13 PM, Fernando Fernandez Mancera wrote:
> > nftables payload-mangling rules can rewrite packet contents (such as TCP
> > flags) before they are evaluated by reject targets. This defeats the
> > content-based loop guards, allowing unbounded hook recursion that leads
> > to kernel stack exhaustion and panics.
> >
> > Fix this by extracting the per-CPU xmit recursion limit previously used
> > by the netdev duplication/forwarding paths into a shared header, and
> > apply it to the inet and inet6 reject transmit functions. It disables BH
> > while transmitting the skb to address a possible migration to different
> > CPU leading to imbalanced decrementation of the recursion counters.
> >
> > Note that the dev_queue_xmit() path used when CONFIG_BRIDGE_NETFILTER is
> > enabled does not require this recursion guard. In that scenario, the
> > generated reset packet is transmitted directly at Layer 2. Because the
> > packet egresses from a different hook, it cannot synchronously loop. In
> > addition nf_send_unreach() and nf_send_unreach6() are safe as the ICMP
> > transmit functions are protected against recursion by the
> > icmp_xmit_lock() and icmpv6_xmit_lock() guards.
> >
> > Reported-by: Yu Junzhe <junzheyu1@gmail.com>
> > Closes: https://lore.kernel.org/netfilter-devel/20260921061320.543-1-junzheyu1@gmail.com/
> > Fixes: bee11dc78fc8 ("netfilter: nft_reject: support for IPv6 and TCP reset")
> > Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
> > ---
> > v3: fixed build robot errors due to the struct member being guarded by
> > CONFIG_NF_DUP_NETDEV instead of CONFIG_NETFILTER and renamed the struct
> > member too.
>
> Is there something missing for this patch? It would be nice if we can get
> this in the next nf.git since it was discover by a real user (or it looks
> like so).
I will include this in the next nf.git batch.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-22 22:06 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-24 20:13 [PATCH nf v3] netfilter: nft_reject: prevent unbounded recursion in output hooks Fernando Fernandez Mancera
2026-10-22 18:32 ` Fernando Fernandez Mancera
2026-10-22 22:06 ` Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.