Re: [PATCH nf v8 2/3] netfilter: nf_dup_netdev: bound asynchronous duplication

[sashiko-bot@kernel.org]

> The task-local transmit recursion counter covers synchronous
> dev_queue_xmit() recursion, but does not follow a duplicated skb through
> asynchronous receive paths. Carry a bounded duplication depth with the skb
> and preserve it across skb and XDP conversions.
> 
> Store the depth in the sk_buff headers group. __copy_skb_header() copies
> that group with a single memcpy(), so skb_clone() preserves the depth.
> Propagate it explicitly when veth converts an skb to an XDP buffer and
> when XDP buffers or frames are converted back to skbs in the core and
> virtio paths. Preserve it through zero-copy XDP frame conversion as well.
> 
> Clear the depth when GRO reuses an skb and when AF_XDP or libeth
> reinitializes a recycled XDP buffer, so a fresh packet does not inherit
> stale recursion state.
> 
> Keep the existing recursion limit and reject MIRRED flow offload where
> the software depth cannot be enforced.
> 
> Fixes: 502061f81d3e ("netfilter: nf_tables: add packet duplication to the netdev family")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Assisted-by: LLM
> Co-developed-by: Luxing Yin <root@tr0jan.top>
> Signed-off-by: Luxing Yin <root@tr0jan.top>
> Signed-off-by: Zihan Xi <zihanx@nebusec.ai>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1792048855.git.zihanx@nebusec.ai?part=2