[PATCH nf] netfilter: nft_fwd_netdev: use recursion counter in neigh egress path

[PATCH nf] netfilter: nft_fwd_netdev: use recursion counter in neigh egress path

[Weiming Shi]

nft_fwd_neigh_eval() can be attached to NF_NETDEV_EGRESS chains since
commit f87b9464d152 ("netfilter: nft_fwd_netdev: Support egress hook").
When a forwarding rule targets the same device (or two devices forward
to each other), the evaluator calls neigh_xmit() which reaches
dev_queue_xmit(), re-entering nf_hook_egress() before the previous
invocation returns. This recurses until the kernel stack is exhausted.

The nf_dup_skb_recursion counter in nf_do_netdev_egress() was added by
commit fcd53c51d037 ("netfilter: nf_dup_netdev: add and use recursion
counter") to prevent exactly this class of bug, but nft_fwd_neigh_eval()
bypasses that helper entirely by calling neigh_xmit() directly.

 BUG: KASAN: slab-out-of-bounds in nft_do_chain (net/netfilter/nf_tables_core.c:287)
 Call Trace:
  nft_do_chain (net/netfilter/nf_tables_core.c:287)
  nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:289)
  nf_hook_slow (include/linux/netfilter.h:158)
  __dev_queue_xmit (net/core/dev.c:4807)
  neigh_resolve_output (include/linux/seqlock.h:392)
  neigh_xmit (net/core/neighbour.c:3230)
  nft_fwd_neigh_eval (net/netfilter/nft_fwd_netdev.c:150)
  nft_do_chain (net/netfilter/nf_tables_core.c:287)
  nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:289)
  nf_hook_slow (include/linux/netfilter.h:158)
  __dev_queue_xmit (net/core/dev.c:4807)
  [repeats until stack exhaustion]

 Kernel panic - not syncing: Fatal exception in interrupt

Export the recursion counter helpers from nf_dup_netdev and use them
in nft_fwd_neigh_eval() to bound the recursion depth, matching the
protection already present in nf_do_netdev_egress().

Fixes: f87b9464d152 ("netfilter: nft_fwd_netdev: Support egress hook")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 include/net/netfilter/nf_dup_netdev.h |  4 ++++
 net/netfilter/nf_dup_netdev.c         | 18 ++++++++++++++++++
 net/netfilter/nft_fwd_netdev.c        |  7 +++++++
 3 files changed, 29 insertions(+)

diff --git a/include/net/netfilter/nf_dup_netdev.h b/include/net/netfilter/nf_dup_netdev.h
index b175d271aec9..17362f76d1d1 100644
--- a/include/net/netfilter/nf_dup_netdev.h
+++ b/include/net/netfilter/nf_dup_netdev.h
@@ -7,6 +7,10 @@
 void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif);
 void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif);
 
+bool nf_dup_netdev_has_recursed(void);
+void nf_dup_netdev_recursion_inc(void);
+void nf_dup_netdev_recursion_dec(void);
+
 struct nft_offload_ctx;
 struct nft_flow_rule;
 
diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
index fab8b9011098..e2fe8bb6fe0d 100644
--- a/net/netfilter/nf_dup_netdev.c
+++ b/net/netfilter/nf_dup_netdev.c
@@ -29,6 +29,24 @@ static u8 *nf_get_nf_dup_skb_recursion(void)
 
 #endif
 
+bool nf_dup_netdev_has_recursed(void)
+{
+	return *nf_get_nf_dup_skb_recursion() > NF_RECURSION_LIMIT;
+}
+EXPORT_SYMBOL_GPL(nf_dup_netdev_has_recursed);
+
+void nf_dup_netdev_recursion_inc(void)
+{
+	(*nf_get_nf_dup_skb_recursion())++;
+}
+EXPORT_SYMBOL_GPL(nf_dup_netdev_recursion_inc);
+
+void nf_dup_netdev_recursion_dec(void)
+{
+	(*nf_get_nf_dup_skb_recursion())--;
+}
+EXPORT_SYMBOL_GPL(nf_dup_netdev_recursion_dec);
+
 static void nf_do_netdev_egress(struct sk_buff *skb, struct net_device *dev,
 				enum nf_dev_hooks hook)
 {
diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
index 152a9fb4d23a..d85f72af3589 100644
--- a/net/netfilter/nft_fwd_netdev.c
+++ b/net/netfilter/nft_fwd_netdev.c
@@ -141,13 +141,20 @@ static void nft_fwd_neigh_eval(const struct nft_expr *expr,
 		goto out;
 	}
 
+	if (nf_dup_netdev_has_recursed()) {
+		verdict = NF_DROP;
+		goto out;
+	}
+
 	dev = dev_get_by_index_rcu(nft_net(pkt), oif);
 	if (dev == NULL)
 		return;
 
 	skb->dev = dev;
 	skb_clear_tstamp(skb);
+	nf_dup_netdev_recursion_inc();
 	neigh_xmit(neigh_table, dev, addr, skb);
+	nf_dup_netdev_recursion_dec();
 out:
 	regs->verdict.code = verdict;
 }
-- 
2.43.0