* [PATCH net 2/2] selftests/tc-testing: Add test case redirecting to self on egress
2025-12-30 19:18 [PATCH net 1/2] net/sched: act_mirred: Fix leak when redirecting to self on egress Jamal Hadi Salim
@ 2025-12-30 19:18 ` Jamal Hadi Salim
2025-12-30 21:32 ` [PATCH net 1/2] net/sched: act_mirred: Fix leak when " Jamal Hadi Salim
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Jamal Hadi Salim @ 2025-12-30 19:18 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, horms, andrew+netdev
Cc: netdev, xiyou.wangcong, jiri, victor
From: Victor Nogueira <victor@mojatatu.com>
Add single mirred test case that attempts to redirect to self on egress
using clsact
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
---
.../tc-testing/tc-tests/actions/mirred.json | 47 +++++++++++++++++++
1 file changed, 47 insertions(+)
diff --git a/tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json b/tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json
index da156feabcbf..b056eb966871 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json
@@ -1098,5 +1098,52 @@
"teardown": [
"$TC qdisc del dev $DUMMY root"
]
+ },
+ {
+ "id": "4ed9",
+ "name": "Try to redirect to self on egress with clsact",
+ "category": [
+ "filter",
+ "mirred"
+ ],
+ "plugins": {
+ "requires": [
+ "nsPlugin"
+ ]
+ },
+ "setup": [
+ "$IP link set dev $DUMMY up || true",
+ "$IP addr add 10.10.10.10/24 dev $DUMMY || true",
+ "$TC qdisc add dev $DUMMY clsact",
+ "$TC filter add dev $DUMMY egress protocol ip prio 10 matchall action mirred egress redirect dev $DUMMY index 1"
+ ],
+ "cmdUnderTest": "ping -c1 -W0.01 -I $DUMMY 10.10.10.1",
+ "expExitCode": "1",
+ "verifyCmd": "$TC -j -s actions get action mirred index 1",
+ "matchJSON": [
+ {
+ "total acts": 0
+ },
+ {
+ "actions": [
+ {
+ "order": 1,
+ "kind": "mirred",
+ "mirred_action": "redirect",
+ "direction": "egress",
+ "index": 1,
+ "stats": {
+ "packets": 1,
+ "overlimits": 1
+ },
+ "not_in_hw": true
+ }
+ ]
+ }
+ ],
+ "teardown": [
+ "$TC qdisc del dev $DUMMY clsact"
+ ]
}
+
]
--
2.52.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH net 1/2] net/sched: act_mirred: Fix leak when redirecting to self on egress
2025-12-30 19:18 [PATCH net 1/2] net/sched: act_mirred: Fix leak when redirecting to self on egress Jamal Hadi Salim
2025-12-30 19:18 ` [PATCH net 2/2] selftests/tc-testing: Add test case " Jamal Hadi Salim
@ 2025-12-30 21:32 ` Jamal Hadi Salim
2026-01-01 21:24 ` kernel test robot
2026-01-04 7:09 ` kernel test robot
3 siblings, 0 replies; 6+ messages in thread
From: Jamal Hadi Salim @ 2025-12-30 21:32 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, horms, andrew+netdev
Cc: netdev, xiyou.wangcong, jiri, victor
On Tue, Dec 30, 2025 at 2:18 PM Jamal Hadi Salim <jhs@mojatatu.com> wrote:
>
> Whenever a mirred redirect to self on egress happens, mirred allocates a
> new skb (skb_to_send). The loop to self check was done after that
> allocation, but was not freeing the newly allocated skb, causing a leak.
>
> Fix this by moving the if-statement to before the allocation of the new
> skb.
>
> The issue was found by running the accompanying tdc test in 2/2
> with config kmemleak enabled.
> After a few minutes the kmemleak thread ran and reported the leak coming from
> mirred.
>
Grr. There is a bug in the print - i will send a new version tomorrow.
cheers,
jamal
> Fixes: 1d856251a009 ("net/sched: act_mirred: fix loop detection")
> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
> ---
> net/sched/act_mirred.c | 22 +++++++++++-----------
> 1 file changed, 11 insertions(+), 11 deletions(-)
>
> diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
> index 91c96cc625bd..c9653b76a4cf 100644
> --- a/net/sched/act_mirred.c
> +++ b/net/sched/act_mirred.c
> @@ -266,6 +266,17 @@ static int tcf_mirred_to_dev(struct sk_buff *skb, struct tcf_mirred *m,
> goto err_cant_do;
> }
>
> + want_ingress = tcf_mirred_act_wants_ingress(m_eaction);
> +
> + if (dev == skb->dev && want_ingress == at_ingress) {
> + pr_notice_once("tc mirred: Loop (%s:%s --> %s:%s)\n",
> + netdev_name(skb->dev),
> + at_ingress ? "ingress" : "egress",
> + netdev_name(dev),
> + want_ingress ? "ingress" : "egress");
> + goto err_cant_do;
> + }
> +
> /* we could easily avoid the clone only if called by ingress and clsact;
> * since we can't easily detect the clsact caller, skip clone only for
> * ingress - that covers the TC S/W datapath.
> @@ -279,17 +290,6 @@ static int tcf_mirred_to_dev(struct sk_buff *skb, struct tcf_mirred *m,
> goto err_cant_do;
> }
>
> - want_ingress = tcf_mirred_act_wants_ingress(m_eaction);
> -
> - if (dev == skb->dev && want_ingress == at_ingress) {
> - pr_notice_once("tc mirred: Loop (%s:%s --> %s:%s)\n",
> - netdev_name(skb->dev),
> - at_ingress ? "ingress" : "egress",
> - netdev_name(dev),
> - want_ingress ? "ingress" : "egress");
> - goto err_cant_do;
> - }
> -
> /* All mirred/redirected skbs should clear previous ct info */
> nf_reset_ct(skb_to_send);
> if (want_ingress && !at_ingress) /* drop dst for egress -> ingress */
> --
> 2.52.0
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH net 1/2] net/sched: act_mirred: Fix leak when redirecting to self on egress
2025-12-30 19:18 [PATCH net 1/2] net/sched: act_mirred: Fix leak when redirecting to self on egress Jamal Hadi Salim
2025-12-30 19:18 ` [PATCH net 2/2] selftests/tc-testing: Add test case " Jamal Hadi Salim
2025-12-30 21:32 ` [PATCH net 1/2] net/sched: act_mirred: Fix leak when " Jamal Hadi Salim
@ 2026-01-01 21:24 ` kernel test robot
2026-01-01 21:45 ` Jamal Hadi Salim
2026-01-04 7:09 ` kernel test robot
3 siblings, 1 reply; 6+ messages in thread
From: kernel test robot @ 2026-01-01 21:24 UTC (permalink / raw)
To: Jamal Hadi Salim, davem, edumazet, kuba, pabeni, horms,
andrew+netdev
Cc: oe-kbuild-all, netdev, xiyou.wangcong, jiri, victor,
Jamal Hadi Salim
Hi Jamal,
kernel test robot noticed the following build warnings:
[auto build test WARNING on net/main]
url: https://github.com/intel-lab-lkp/linux/commits/Jamal-Hadi-Salim/selftests-tc-testing-Add-test-case-redirecting-to-self-on-egress/20251231-031934
base: net/main
patch link: https://lore.kernel.org/r/20251230191814.213789-1-jhs%40mojatatu.com
patch subject: [PATCH net 1/2] net/sched: act_mirred: Fix leak when redirecting to self on egress
config: i386-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20260101/202601012235.hi5VYzYy-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260101/202601012235.hi5VYzYy-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202601012235.hi5VYzYy-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> net/sched/act_mirred.c:271:41: warning: variable 'at_ingress' is uninitialized when used here [-Wuninitialized]
271 | if (dev == skb->dev && want_ingress == at_ingress) {
| ^~~~~~~~~~
net/sched/act_mirred.c:256:17: note: initialize the variable 'at_ingress' to silence this warning
256 | bool at_ingress;
| ^
| = 0
1 warning generated.
vim +/at_ingress +271 net/sched/act_mirred.c
246
247 static int tcf_mirred_to_dev(struct sk_buff *skb, struct tcf_mirred *m,
248 struct net_device *dev,
249 const bool m_mac_header_xmit, int m_eaction,
250 int retval)
251 {
252 struct sk_buff *skb_to_send = skb;
253 bool want_ingress;
254 bool is_redirect;
255 bool expects_nh;
256 bool at_ingress;
257 bool dont_clone;
258 int mac_len;
259 bool at_nh;
260 int err;
261
262 is_redirect = tcf_mirred_is_act_redirect(m_eaction);
263 if (unlikely(!(dev->flags & IFF_UP)) || !netif_carrier_ok(dev)) {
264 net_notice_ratelimited("tc mirred to Houston: device %s is down\n",
265 dev->name);
266 goto err_cant_do;
267 }
268
269 want_ingress = tcf_mirred_act_wants_ingress(m_eaction);
270
> 271 if (dev == skb->dev && want_ingress == at_ingress) {
272 pr_notice_once("tc mirred: Loop (%s:%s --> %s:%s)\n",
273 netdev_name(skb->dev),
274 at_ingress ? "ingress" : "egress",
275 netdev_name(dev),
276 want_ingress ? "ingress" : "egress");
277 goto err_cant_do;
278 }
279
280 /* we could easily avoid the clone only if called by ingress and clsact;
281 * since we can't easily detect the clsact caller, skip clone only for
282 * ingress - that covers the TC S/W datapath.
283 */
284 at_ingress = skb_at_tc_ingress(skb);
285 dont_clone = skb_at_tc_ingress(skb) && is_redirect &&
286 tcf_mirred_can_reinsert(retval);
287 if (!dont_clone) {
288 skb_to_send = skb_clone(skb, GFP_ATOMIC);
289 if (!skb_to_send)
290 goto err_cant_do;
291 }
292
293 /* All mirred/redirected skbs should clear previous ct info */
294 nf_reset_ct(skb_to_send);
295 if (want_ingress && !at_ingress) /* drop dst for egress -> ingress */
296 skb_dst_drop(skb_to_send);
297
298 expects_nh = want_ingress || !m_mac_header_xmit;
299 at_nh = skb->data == skb_network_header(skb);
300 if (at_nh != expects_nh) {
301 mac_len = at_ingress ? skb->mac_len :
302 skb_network_offset(skb);
303 if (expects_nh) {
304 /* target device/action expect data at nh */
305 skb_pull_rcsum(skb_to_send, mac_len);
306 } else {
307 /* target device/action expect data at mac */
308 skb_push_rcsum(skb_to_send, mac_len);
309 }
310 }
311
312 skb_to_send->skb_iif = skb->dev->ifindex;
313 skb_to_send->dev = dev;
314
315 if (is_redirect) {
316 if (skb == skb_to_send)
317 retval = TC_ACT_CONSUMED;
318
319 skb_set_redirected(skb_to_send, skb_to_send->tc_at_ingress);
320
321 err = tcf_mirred_forward(at_ingress, want_ingress, skb_to_send);
322 } else {
323 err = tcf_mirred_forward(at_ingress, want_ingress, skb_to_send);
324 }
325 if (err)
326 tcf_action_inc_overlimit_qstats(&m->common);
327
328 return retval;
329
330 err_cant_do:
331 if (is_redirect)
332 retval = TC_ACT_SHOT;
333 tcf_action_inc_overlimit_qstats(&m->common);
334 return retval;
335 }
336
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH net 1/2] net/sched: act_mirred: Fix leak when redirecting to self on egress
2026-01-01 21:24 ` kernel test robot
@ 2026-01-01 21:45 ` Jamal Hadi Salim
0 siblings, 0 replies; 6+ messages in thread
From: Jamal Hadi Salim @ 2026-01-01 21:45 UTC (permalink / raw)
To: kernel test robot
Cc: davem, edumazet, kuba, pabeni, horms, andrew+netdev,
oe-kbuild-all, netdev, xiyou.wangcong, jiri, victor
On Thu, Jan 1, 2026 at 4:26 PM kernel test robot <lkp@intel.com> wrote:
>
> Hi Jamal,
Hi Kernel test robot!
>
> kernel test robot noticed the following build warnings:
>
> [auto build test WARNING on net/main]
>
> url: https://github.com/intel-lab-lkp/linux/commits/Jamal-Hadi-Salim/selftests-tc-testing-Add-test-case-redirecting-to-self-on-egress/20251231-031934
> base: net/main
> patch link: https://lore.kernel.org/r/20251230191814.213789-1-jhs%40mojatatu.com
> patch subject: [PATCH net 1/2] net/sched: act_mirred: Fix leak when redirecting to self on egress
> config: i386-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20260101/202601012235.hi5VYzYy-lkp@intel.com/config)
> compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
> reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260101/202601012235.hi5VYzYy-lkp@intel.com/reproduce)
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202601012235.hi5VYzYy-lkp@intel.com/
>
> All warnings (new ones prefixed by >>):
>
> >> net/sched/act_mirred.c:271:41: warning: variable 'at_ingress' is uninitialized when used here [-Wuninitialized]
> 271 | if (dev == skb->dev && want_ingress == at_ingress) {
> | ^~~~~~~~~~
> net/sched/act_mirred.c:256:17: note: initialize the variable 'at_ingress' to silence this warning
> 256 | bool at_ingress;
> | ^
> | = 0
> 1 warning generated.
>
You are about 2 days late. See:
https://patchwork.kernel.org/project/netdevbpf/patch/20260101135608.253079-2-jhs@mojatatu.com/
[..]
cheers,
jamal
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net 1/2] net/sched: act_mirred: Fix leak when redirecting to self on egress
2025-12-30 19:18 [PATCH net 1/2] net/sched: act_mirred: Fix leak when redirecting to self on egress Jamal Hadi Salim
` (2 preceding siblings ...)
2026-01-01 21:24 ` kernel test robot
@ 2026-01-04 7:09 ` kernel test robot
3 siblings, 0 replies; 6+ messages in thread
From: kernel test robot @ 2026-01-04 7:09 UTC (permalink / raw)
To: Jamal Hadi Salim, davem, edumazet, kuba, pabeni, horms,
andrew+netdev
Cc: llvm, oe-kbuild-all, netdev, xiyou.wangcong, jiri, victor,
Jamal Hadi Salim
Hi Jamal,
kernel test robot noticed the following build warnings:
[auto build test WARNING on net/main]
url: https://github.com/intel-lab-lkp/linux/commits/Jamal-Hadi-Salim/selftests-tc-testing-Add-test-case-redirecting-to-self-on-egress/20251231-031934
base: net/main
patch link: https://lore.kernel.org/r/20251230191814.213789-1-jhs%40mojatatu.com
patch subject: [PATCH net 1/2] net/sched: act_mirred: Fix leak when redirecting to self on egress
config: hexagon-allmodconfig (https://download.01.org/0day-ci/archive/20260104/202601041445.FfX5dT9n-lkp@intel.com/config)
compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260104/202601041445.FfX5dT9n-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202601041445.FfX5dT9n-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> net/sched/act_mirred.c:271:41: warning: variable 'at_ingress' is uninitialized when used here [-Wuninitialized]
271 | if (dev == skb->dev && want_ingress == at_ingress) {
| ^~~~~~~~~~
net/sched/act_mirred.c:256:17: note: initialize the variable 'at_ingress' to silence this warning
256 | bool at_ingress;
| ^
| = 0
1 warning generated.
vim +/at_ingress +271 net/sched/act_mirred.c
246
247 static int tcf_mirred_to_dev(struct sk_buff *skb, struct tcf_mirred *m,
248 struct net_device *dev,
249 const bool m_mac_header_xmit, int m_eaction,
250 int retval)
251 {
252 struct sk_buff *skb_to_send = skb;
253 bool want_ingress;
254 bool is_redirect;
255 bool expects_nh;
256 bool at_ingress;
257 bool dont_clone;
258 int mac_len;
259 bool at_nh;
260 int err;
261
262 is_redirect = tcf_mirred_is_act_redirect(m_eaction);
263 if (unlikely(!(dev->flags & IFF_UP)) || !netif_carrier_ok(dev)) {
264 net_notice_ratelimited("tc mirred to Houston: device %s is down\n",
265 dev->name);
266 goto err_cant_do;
267 }
268
269 want_ingress = tcf_mirred_act_wants_ingress(m_eaction);
270
> 271 if (dev == skb->dev && want_ingress == at_ingress) {
272 pr_notice_once("tc mirred: Loop (%s:%s --> %s:%s)\n",
273 netdev_name(skb->dev),
274 at_ingress ? "ingress" : "egress",
275 netdev_name(dev),
276 want_ingress ? "ingress" : "egress");
277 goto err_cant_do;
278 }
279
280 /* we could easily avoid the clone only if called by ingress and clsact;
281 * since we can't easily detect the clsact caller, skip clone only for
282 * ingress - that covers the TC S/W datapath.
283 */
284 at_ingress = skb_at_tc_ingress(skb);
285 dont_clone = skb_at_tc_ingress(skb) && is_redirect &&
286 tcf_mirred_can_reinsert(retval);
287 if (!dont_clone) {
288 skb_to_send = skb_clone(skb, GFP_ATOMIC);
289 if (!skb_to_send)
290 goto err_cant_do;
291 }
292
293 /* All mirred/redirected skbs should clear previous ct info */
294 nf_reset_ct(skb_to_send);
295 if (want_ingress && !at_ingress) /* drop dst for egress -> ingress */
296 skb_dst_drop(skb_to_send);
297
298 expects_nh = want_ingress || !m_mac_header_xmit;
299 at_nh = skb->data == skb_network_header(skb);
300 if (at_nh != expects_nh) {
301 mac_len = at_ingress ? skb->mac_len :
302 skb_network_offset(skb);
303 if (expects_nh) {
304 /* target device/action expect data at nh */
305 skb_pull_rcsum(skb_to_send, mac_len);
306 } else {
307 /* target device/action expect data at mac */
308 skb_push_rcsum(skb_to_send, mac_len);
309 }
310 }
311
312 skb_to_send->skb_iif = skb->dev->ifindex;
313 skb_to_send->dev = dev;
314
315 if (is_redirect) {
316 if (skb == skb_to_send)
317 retval = TC_ACT_CONSUMED;
318
319 skb_set_redirected(skb_to_send, skb_to_send->tc_at_ingress);
320
321 err = tcf_mirred_forward(at_ingress, want_ingress, skb_to_send);
322 } else {
323 err = tcf_mirred_forward(at_ingress, want_ingress, skb_to_send);
324 }
325 if (err)
326 tcf_action_inc_overlimit_qstats(&m->common);
327
328 return retval;
329
330 err_cant_do:
331 if (is_redirect)
332 retval = TC_ACT_SHOT;
333 tcf_action_inc_overlimit_qstats(&m->common);
334 return retval;
335 }
336
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 6+ messages in thread