Re: [PATCH net v2 0/6] net/sched: Fix packet loops in mirred and netem

[Stephen Hemminger <stephen@networkplumber.org>]

On Mon, 16 Mar 2026 17:10:46 -0400
Jamal Hadi Salim <jhs@mojatatu.com> wrote:

> We introduce a 2-bit global skb->ttl counter. Patch #1 describes how we put
> together those bits. Patches #2 and patch #5 use these bits.
> I added Fixes tags to patch #1 in case it is useful for backporting.
> Patch #3 and #4 revert William's earlier netem commits. Patch #6 introduces
> tdc test cases.
> 
> Changes in v2:
> Do not reuse skb->from_ingress (which was move skb->cb)
> 
> Jamal Hadi Salim (5):
>   net: Introduce skb ttl field to track packet loops
>   net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop
>   Revert "net/sched: Restrict conditions for adding duplicating netems
>     to qdisc tree"
>   Revert "selftests/tc-testing: Add tests for restrictions on netem
>     duplication"
>   net/sched: fix packet loop on netem when duplicate is on
> 
> Victor Nogueira (1):
>   selftests/tc-testing: Add netem/mirred test cases exercising loops
> 
>  include/linux/skbuff.h                        |   2 +
>  net/sched/act_mirred.c                        |  45 +-
>  net/sched/sch_netem.c                         |  47 +-
>  .../tc-testing/tc-tests/actions/mirred.json   | 616 +++++++++++++++++-
>  .../tc-testing/tc-tests/infra/qdiscs.json     |   5 +-
>  .../tc-testing/tc-tests/qdiscs/netem.json     |  96 +--
>  6 files changed, 674 insertions(+), 137 deletions(-)
> 

I would also like to add additional guard rails here for netem, and you
might consider the same for mirred.

 1. Do not allow duplicate option outside of root namespace.
 2. Cap the duplicate fraction at some rationale lower bound like 25%