[PATCH net v2 0/3] net: fix lwtunnel reentry loops

[PATCH net v2 0/3] net: fix lwtunnel reentry loops

[Justin Iurman]

v2:
- removed some patches from the -v1 series
- added a patch that was initially sent separately
- code style for the selftest (thanks Paolo)
v1:
- https://lore.kernel.org/all/20250311141238.19862-1-justin.iurman@uliege.be/

When the destination is the same after the transformation, we enter a
lwtunnel loop. This is true for most of lwt users: ioam6, rpl, seg6,
seg6_local, ila_lwt, and lwt_bpf. It can happen in their input() and
output() handlers respectively, where either dst_input() or dst_output()
is called at the end. It can also happen in xmit() handlers.

Here is an example for rpl_input():

dump_stack_lvl+0x60/0x80
rpl_input+0x9d/0x320
lwtunnel_input+0x64/0xa0
lwtunnel_input+0x64/0xa0
lwtunnel_input+0x64/0xa0
lwtunnel_input+0x64/0xa0
lwtunnel_input+0x64/0xa0
[...]
lwtunnel_input+0x64/0xa0
lwtunnel_input+0x64/0xa0
lwtunnel_input+0x64/0xa0
lwtunnel_input+0x64/0xa0
lwtunnel_input+0x64/0xa0
ip6_sublist_rcv_finish+0x85/0x90
ip6_sublist_rcv+0x236/0x2f0

... until rpl_do_srh() fails, which means skb_cow_head() failed.

This series provides a fix at the core level of lwtunnel to catch such
loops when they're not caught by the respective lwtunnel users, and
handle the loop case in ioam6 which is one of the users. This series
also comes with a new selftest to detect some dst cache reference loops
in lwtunnel users.

Justin Iurman (3):
  net: lwtunnel: fix recursion loops
  net: ipv6: ioam6: fix lwtunnel_output() loop
  selftests: net: test for lwtunnel dst ref loops

 net/core/lwtunnel.c                           |  65 ++++-
 net/ipv6/ioam6_iptunnel.c                     |   8 +-
 tools/testing/selftests/net/Makefile          |   1 +
 tools/testing/selftests/net/config            |   2 +
 .../selftests/net/lwt_dst_cache_ref_loop.sh   | 246 ++++++++++++++++++
 5 files changed, 306 insertions(+), 16 deletions(-)
 create mode 100755 tools/testing/selftests/net/lwt_dst_cache_ref_loop.sh

-- 
2.34.1

[PATCH net v2 1/3] net: lwtunnel: fix recursion loops

[Justin Iurman]

This patch acts as a parachute, catch all solution, by detecting
recursion loops in lwtunnel users and taking care of them (e.g., a loop
between routes, a loop within the same route, etc). In general, such
loops are the consequence of pathological configurations. Each lwtunnel
user is still free to catch such loops early and do whatever they want
with them. It will be the case in a separate patch for, e.g., seg6 and
seg6_local, in order to provide drop reasons and update statistics.
Another example of a lwtunnel user taking care of loops is ioam6, which
has valid use cases that include loops (e.g., inline mode), and which is
addressed by the next patch in this series. Overall, this patch acts as
a last resort to catch loops and drop packets, since we don't want to
leak something unintentionally because of a pathological configuration
in lwtunnels.

The solution in this patch reuses dev_xmit_recursion(),
dev_xmit_recursion_inc(), and dev_xmit_recursion_dec(), which seems fine
considering the context.

Closes: https://lore.kernel.org/netdev/2bc9e2079e864a9290561894d2a602d6@akamai.com/
Closes: https://lore.kernel.org/netdev/Z7NKYMY7fJT5cYWu@shredder/
Fixes: ffce41962ef6 ("lwtunnel: support dst output redirect function")
Fixes: 2536862311d2 ("lwt: Add support to redirect dst.input")
Fixes: 14972cbd34ff ("net: lwtunnel: Handle fragmentation")
Signed-off-by: Justin Iurman <justin.iurman@uliege.be>
---
Cc: Roopa Prabhu <roopa@nvidia.com>
Cc: Andrea Mayer <andrea.mayer@uniroma2.it>
Cc: Stefano Salsano <stefano.salsano@uniroma2.it>
Cc: Ahmed Abdelsalam <ahabdels.dev@gmail.com>
Cc: Ido Schimmel <idosch@nvidia.com>
---
 net/core/lwtunnel.c | 65 ++++++++++++++++++++++++++++++++++++---------
 1 file changed, 53 insertions(+), 12 deletions(-)

diff --git a/net/core/lwtunnel.c b/net/core/lwtunnel.c
index 711cd3b4347a..4417a18b3e95 100644
--- a/net/core/lwtunnel.c
+++ b/net/core/lwtunnel.c
@@ -23,6 +23,8 @@
 #include <net/ip6_fib.h>
 #include <net/rtnh.h>
 
+#include "dev.h"
+
 DEFINE_STATIC_KEY_FALSE(nf_hooks_lwtunnel_enabled);
 EXPORT_SYMBOL_GPL(nf_hooks_lwtunnel_enabled);
 
@@ -325,13 +327,23 @@ EXPORT_SYMBOL_GPL(lwtunnel_cmp_encap);
 
 int lwtunnel_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
-	struct dst_entry *dst = skb_dst(skb);
 	const struct lwtunnel_encap_ops *ops;
 	struct lwtunnel_state *lwtstate;
-	int ret = -EINVAL;
+	struct dst_entry *dst;
+	int ret;
+
+	if (dev_xmit_recursion()) {
+		net_crit_ratelimited("%s(): recursion limit reached on datapath\n",
+				     __func__);
+		ret = -ENETDOWN;
+		goto drop;
+	}
 
-	if (!dst)
+	dst = skb_dst(skb);
+	if (!dst) {
+		ret = -EINVAL;
 		goto drop;
+	}
 	lwtstate = dst->lwtstate;
 
 	if (lwtstate->type == LWTUNNEL_ENCAP_NONE ||
@@ -341,8 +353,11 @@ int lwtunnel_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 	ret = -EOPNOTSUPP;
 	rcu_read_lock();
 	ops = rcu_dereference(lwtun_encaps[lwtstate->type]);
-	if (likely(ops && ops->output))
+	if (likely(ops && ops->output)) {
+		dev_xmit_recursion_inc();
 		ret = ops->output(net, sk, skb);
+		dev_xmit_recursion_dec();
+	}
 	rcu_read_unlock();
 
 	if (ret == -EOPNOTSUPP)
@@ -359,13 +374,23 @@ EXPORT_SYMBOL_GPL(lwtunnel_output);
 
 int lwtunnel_xmit(struct sk_buff *skb)
 {
-	struct dst_entry *dst = skb_dst(skb);
 	const struct lwtunnel_encap_ops *ops;
 	struct lwtunnel_state *lwtstate;
-	int ret = -EINVAL;
+	struct dst_entry *dst;
+	int ret;
+
+	if (dev_xmit_recursion()) {
+		net_crit_ratelimited("%s(): recursion limit reached on datapath\n",
+				     __func__);
+		ret = -ENETDOWN;
+		goto drop;
+	}
 
-	if (!dst)
+	dst = skb_dst(skb);
+	if (!dst) {
+		ret = -EINVAL;
 		goto drop;
+	}
 
 	lwtstate = dst->lwtstate;
 
@@ -376,8 +401,11 @@ int lwtunnel_xmit(struct sk_buff *skb)
 	ret = -EOPNOTSUPP;
 	rcu_read_lock();
 	ops = rcu_dereference(lwtun_encaps[lwtstate->type]);
-	if (likely(ops && ops->xmit))
+	if (likely(ops && ops->xmit)) {
+		dev_xmit_recursion_inc();
 		ret = ops->xmit(skb);
+		dev_xmit_recursion_dec();
+	}
 	rcu_read_unlock();
 
 	if (ret == -EOPNOTSUPP)
@@ -394,13 +422,23 @@ EXPORT_SYMBOL_GPL(lwtunnel_xmit);
 
 int lwtunnel_input(struct sk_buff *skb)
 {
-	struct dst_entry *dst = skb_dst(skb);
 	const struct lwtunnel_encap_ops *ops;
 	struct lwtunnel_state *lwtstate;
-	int ret = -EINVAL;
+	struct dst_entry *dst;
+	int ret;
 
-	if (!dst)
+	if (dev_xmit_recursion()) {
+		net_crit_ratelimited("%s(): recursion limit reached on datapath\n",
+				     __func__);
+		ret = -ENETDOWN;
 		goto drop;
+	}
+
+	dst = skb_dst(skb);
+	if (!dst) {
+		ret = -EINVAL;
+		goto drop;
+	}
 	lwtstate = dst->lwtstate;
 
 	if (lwtstate->type == LWTUNNEL_ENCAP_NONE ||
@@ -410,8 +448,11 @@ int lwtunnel_input(struct sk_buff *skb)
 	ret = -EOPNOTSUPP;
 	rcu_read_lock();
 	ops = rcu_dereference(lwtun_encaps[lwtstate->type]);
-	if (likely(ops && ops->input))
+	if (likely(ops && ops->input)) {
+		dev_xmit_recursion_inc();
 		ret = ops->input(skb);
+		dev_xmit_recursion_dec();
+	}
 	rcu_read_unlock();
 
 	if (ret == -EOPNOTSUPP)
-- 
2.34.1

[PATCH net v2 2/3] net: ipv6: ioam6: fix lwtunnel_output() loop

[Justin Iurman]

Fix the lwtunnel_output() reentry loop in ioam6_iptunnel when the
destination is the same after transformation. Note that a check on the
destination address was already performed, but it was not enough. This
is the example of a lwtunnel user taking care of loops without relying
only on the last resort detection offered by lwtunnel.

Fixes: 8cb3bf8bff3c ("ipv6: ioam: Add support for the ip6ip6 encapsulation")
Signed-off-by: Justin Iurman <justin.iurman@uliege.be>
---
Cc: Ido Schimmel <idosch@nvidia.com>
---
 net/ipv6/ioam6_iptunnel.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/ipv6/ioam6_iptunnel.c b/net/ipv6/ioam6_iptunnel.c
index 2c383c12a431..09065187378e 100644
--- a/net/ipv6/ioam6_iptunnel.c
+++ b/net/ipv6/ioam6_iptunnel.c
@@ -337,7 +337,6 @@ static int ioam6_do_encap(struct net *net, struct sk_buff *skb,
 static int ioam6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
 	struct dst_entry *dst = skb_dst(skb), *cache_dst = NULL;
-	struct in6_addr orig_daddr;
 	struct ioam6_lwt *ilwt;
 	int err = -EINVAL;
 	u32 pkt_cnt;
@@ -352,8 +351,6 @@ static int ioam6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 	if (pkt_cnt % ilwt->freq.n >= ilwt->freq.k)
 		goto out;
 
-	orig_daddr = ipv6_hdr(skb)->daddr;
-
 	local_bh_disable();
 	cache_dst = dst_cache_get(&ilwt->cache);
 	local_bh_enable();
@@ -422,7 +419,10 @@ static int ioam6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 			goto drop;
 	}
 
-	if (!ipv6_addr_equal(&orig_daddr, &ipv6_hdr(skb)->daddr)) {
+	/* avoid lwtunnel_output() reentry loop when destination is the same
+	 * after transformation (e.g., with the inline mode)
+	 */
+	if (dst->lwtstate != cache_dst->lwtstate) {
 		skb_dst_drop(skb);
 		skb_dst_set(skb, cache_dst);
 		return dst_output(net, sk, skb);
-- 
2.34.1

[PATCH net v2 3/3] selftests: net: test for lwtunnel dst ref loops

[Justin Iurman]

As recently specified by commit 0ea09cbf8350 ("docs: netdev: add a note
on selftest posting") in net-next, the selftest is therefore shipped in
this series. However, this selftest does not really test this series. It
needs this series to avoid crashing the kernel. What it really tests,
thanks to kmemleak, is what was fixed by the following commits:
- commit c71a192976de ("net: ipv6: fix dst refleaks in rpl, seg6 and
ioam6 lwtunnels")
- commit 92191dd10730 ("net: ipv6: fix dst ref loops in rpl, seg6 and
ioam6 lwtunnels")
- commit c64a0727f9b1 ("net: ipv6: fix dst ref loop on input in seg6
lwt")
- commit 13e55fbaec17 ("net: ipv6: fix dst ref loop on input in rpl
lwt")
- commit 0e7633d7b95b ("net: ipv6: fix dst ref loop in ila lwtunnel")
- commit 5da15a9c11c1 ("net: ipv6: fix missing dst ref drop in ila
lwtunnel")

Signed-off-by: Justin Iurman <justin.iurman@uliege.be>
---
Cc: Shuah Khan <shuah@kernel.org>
Cc: linux-kselftest@vger.kernel.org
---
 tools/testing/selftests/net/Makefile          |   1 +
 tools/testing/selftests/net/config            |   2 +
 .../selftests/net/lwt_dst_cache_ref_loop.sh   | 246 ++++++++++++++++++
 3 files changed, 249 insertions(+)
 create mode 100755 tools/testing/selftests/net/lwt_dst_cache_ref_loop.sh

diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index 5916f3b81c39..843ab747645d 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -101,6 +101,7 @@ TEST_PROGS += vlan_bridge_binding.sh
 TEST_PROGS += bpf_offload.py
 TEST_PROGS += ipv6_route_update_soft_lockup.sh
 TEST_PROGS += busy_poll_test.sh
+TEST_PROGS += lwt_dst_cache_ref_loop.sh
 
 # YNL files, must be before "include ..lib.mk"
 YNL_GEN_FILES := busy_poller netlink-dumps
diff --git a/tools/testing/selftests/net/config b/tools/testing/selftests/net/config
index 5b9baf708950..61e5116987f3 100644
--- a/tools/testing/selftests/net/config
+++ b/tools/testing/selftests/net/config
@@ -107,3 +107,5 @@ CONFIG_XFRM_INTERFACE=m
 CONFIG_XFRM_USER=m
 CONFIG_IP_NF_MATCH_RPFILTER=m
 CONFIG_IP6_NF_MATCH_RPFILTER=m
+CONFIG_IPV6_ILA=m
+CONFIG_IPV6_RPL_LWTUNNEL=y
diff --git a/tools/testing/selftests/net/lwt_dst_cache_ref_loop.sh b/tools/testing/selftests/net/lwt_dst_cache_ref_loop.sh
new file mode 100755
index 000000000000..881eb399798f
--- /dev/null
+++ b/tools/testing/selftests/net/lwt_dst_cache_ref_loop.sh
@@ -0,0 +1,246 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0+
+#
+# Author: Justin Iurman <justin.iurman@uliege.be>
+#
+# WARNING
+# -------
+# This is just a dummy script that triggers encap cases with possible dst cache
+# reference loops in affected lwt users (see list below). Some cases are
+# pathological configurations for simplicity, others are valid. Overall, we
+# don't want this issue to happen, no matter what. In order to catch any
+# reference loops, kmemleak MUST be used. The results alone are always blindly
+# successful, don't rely on them. Note that the following tests may crash the
+# kernel if the fix to prevent lwtunnel_{input|output|xmit}() reentry loops is
+# not present.
+#
+# Affected lwt users so far (please update accordingly if needed):
+#  - ila_lwt (output only)
+#  - ioam6_iptunnel (output only)
+#  - rpl_iptunnel (both input and output)
+#  - seg6_iptunnel (both input and output)
+
+source lib.sh
+
+check_compatibility()
+{
+	setup_ns tmp_node &>/dev/null
+	if [ $? != 0 ]; then
+		echo "SKIP: Cannot create netns."
+		exit $ksft_skip
+	fi
+
+	ip link add name veth0 netns $tmp_node type veth \
+		peer name veth1 netns $tmp_node &>/dev/null
+	local ret=$?
+
+	ip -netns $tmp_node link set veth0 up &>/dev/null
+	ret=$((ret + $?))
+
+	ip -netns $tmp_node link set veth1 up &>/dev/null
+	ret=$((ret + $?))
+
+	if [ $ret != 0 ]; then
+		echo "SKIP: Cannot configure links."
+		cleanup_ns $tmp_node
+		exit $ksft_skip
+	fi
+
+	lsmod 2>/dev/null | grep -q "ila"
+	ila_lsmod=$?
+	[ $ila_lsmod != 0 ] && modprobe ila &>/dev/null
+
+	ip -netns $tmp_node route add 2001:db8:1::/64 \
+		encap ila 1:2:3:4 csum-mode no-action ident-type luid \
+			hook-type output \
+		dev veth0 &>/dev/null
+
+	ip -netns $tmp_node route add 2001:db8:2::/64 \
+		encap ioam6 trace prealloc type 0x800000 ns 0 size 4 \
+		dev veth0 &>/dev/null
+
+	ip -netns $tmp_node route add 2001:db8:3::/64 \
+		encap rpl segs 2001:db8:3::1 dev veth0 &>/dev/null
+
+	ip -netns $tmp_node route add 2001:db8:4::/64 \
+		encap seg6 mode inline segs 2001:db8:4::1 dev veth0 &>/dev/null
+
+	ip -netns $tmp_node -6 route 2>/dev/null | grep -q "encap ila"
+	skip_ila=$?
+
+	ip -netns $tmp_node -6 route 2>/dev/null | grep -q "encap ioam6"
+	skip_ioam6=$?
+
+	ip -netns $tmp_node -6 route 2>/dev/null | grep -q "encap rpl"
+	skip_rpl=$?
+
+	ip -netns $tmp_node -6 route 2>/dev/null | grep -q "encap seg6"
+	skip_seg6=$?
+
+	cleanup_ns $tmp_node
+}
+
+setup()
+{
+	setup_ns alpha beta gamma &>/dev/null
+
+	ip link add name veth-alpha netns $alpha type veth \
+		peer name veth-betaL netns $beta &>/dev/null
+
+	ip link add name veth-betaR netns $beta type veth \
+		peer name veth-gamma netns $gamma &>/dev/null
+
+	ip -netns $alpha link set veth-alpha name veth0 &>/dev/null
+	ip -netns $beta link set veth-betaL name veth0 &>/dev/null
+	ip -netns $beta link set veth-betaR name veth1 &>/dev/null
+	ip -netns $gamma link set veth-gamma name veth0 &>/dev/null
+
+	ip -netns $alpha addr add 2001:db8:1::2/64 dev veth0 &>/dev/null
+	ip -netns $alpha link set veth0 up &>/dev/null
+	ip -netns $alpha link set lo up &>/dev/null
+	ip -netns $alpha route add 2001:db8:2::/64 \
+		via 2001:db8:1::1 dev veth0 &>/dev/null
+
+	ip -netns $beta addr add 2001:db8:1::1/64 dev veth0 &>/dev/null
+	ip -netns $beta addr add 2001:db8:2::1/64 dev veth1 &>/dev/null
+	ip -netns $beta link set veth0 up &>/dev/null
+	ip -netns $beta link set veth1 up &>/dev/null
+	ip -netns $beta link set lo up &>/dev/null
+	ip -netns $beta route del 2001:db8:2::/64
+	ip -netns $beta route add 2001:db8:2::/64 dev veth1
+	ip netns exec $beta \
+		sysctl -wq net.ipv6.conf.all.forwarding=1 &>/dev/null
+
+	ip -netns $gamma addr add 2001:db8:2::2/64 dev veth0 &>/dev/null
+	ip -netns $gamma link set veth0 up &>/dev/null
+	ip -netns $gamma link set lo up &>/dev/null
+	ip -netns $gamma route add 2001:db8:1::/64 \
+		via 2001:db8:2::1 dev veth0 &>/dev/null
+
+	sleep 1
+
+	ip netns exec $alpha ping6 -c 5 -W 1 2001:db8:2::2 &>/dev/null
+	if [ $? != 0 ]; then
+		echo "SKIP: Setup failed."
+		exit $ksft_skip
+	fi
+
+	sleep 1
+}
+
+cleanup()
+{
+	cleanup_ns $alpha $beta $gamma
+	[ $ila_lsmod != 0 ] && modprobe -r ila &>/dev/null
+}
+
+run_ila()
+{
+	if [ $skip_ila != 0 ]; then
+		echo "SKIP: ila (output)"
+		return
+	fi
+
+	ip -netns $beta route del 2001:db8:2::/64
+	ip -netns $beta route add 2001:db8:2:0:0:0:0:2/128 \
+		encap ila 2001:db8:2:0 csum-mode no-action ident-type luid \
+			hook-type output \
+		dev veth1 &>/dev/null
+	sleep 1
+
+	echo "TEST: ila (output)"
+	ip netns exec $beta ping6 -c 2 -W 1 2001:db8:2::2 &>/dev/null
+	sleep 1
+
+	ip -netns $beta route del 2001:db8:2:0:0:0:0:2/128
+	ip -netns $beta route add 2001:db8:2::/64 dev veth1
+	sleep 1
+}
+
+run_ioam6()
+{
+	if [ $skip_ioam6 != 0 ]; then
+		echo "SKIP: ioam6 (output)"
+		return
+	fi
+
+	ip -netns $beta route change 2001:db8:2::/64 \
+		encap ioam6 trace prealloc type 0x800000 ns 1 size 4 \
+		dev veth1 &>/dev/null
+	sleep 1
+
+	echo "TEST: ioam6 (output)"
+	ip netns exec $beta ping6 -c 2 -W 1 2001:db8:2::2 &>/dev/null
+	sleep 1
+}
+
+run_rpl()
+{
+	if [ $skip_rpl != 0 ]; then
+		echo "SKIP: rpl (input)"
+		echo "SKIP: rpl (output)"
+		return
+	fi
+
+	ip -netns $beta route change 2001:db8:2::/64 \
+		encap rpl segs 2001:db8:2::2 \
+		dev veth1 &>/dev/null
+	sleep 1
+
+	echo "TEST: rpl (input)"
+	ip netns exec $alpha ping6 -c 2 -W 1 2001:db8:2::2 &>/dev/null
+	sleep 1
+
+	echo "TEST: rpl (output)"
+	ip netns exec $beta ping6 -c 2 -W 1 2001:db8:2::2 &>/dev/null
+	sleep 1
+}
+
+run_seg6()
+{
+	if [ $skip_seg6 != 0 ]; then
+		echo "SKIP: seg6 (input)"
+		echo "SKIP: seg6 (output)"
+		return
+	fi
+
+	ip -netns $beta route change 2001:db8:2::/64 \
+		encap seg6 mode inline segs 2001:db8:2::2 \
+		dev veth1 &>/dev/null
+	sleep 1
+
+	echo "TEST: seg6 (input)"
+	ip netns exec $alpha ping6 -c 2 -W 1 2001:db8:2::2 &>/dev/null
+	sleep 1
+
+	echo "TEST: seg6 (output)"
+	ip netns exec $beta ping6 -c 2 -W 1 2001:db8:2::2 &>/dev/null
+	sleep 1
+}
+
+run()
+{
+	run_ila
+	run_ioam6
+	run_rpl
+	run_seg6
+}
+
+if [ "$(id -u)" -ne 0 ]; then
+	echo "SKIP: Need root privileges."
+	exit $ksft_skip
+fi
+
+if [ ! -x "$(command -v ip)" ]; then
+	echo "SKIP: Could not run test without ip tool."
+	exit $ksft_skip
+fi
+
+check_compatibility
+
+trap cleanup EXIT
+
+setup
+run
+
+exit $ksft_pass
-- 
2.34.1

Re: [PATCH net v2 3/3] selftests: net: test for lwtunnel dst ref loops

[Paolo Abeni]

On 3/14/25 1:00 PM, Justin Iurman wrote:
> As recently specified by commit 0ea09cbf8350 ("docs: netdev: add a note
> on selftest posting") in net-next, the selftest is therefore shipped in
> this series. However, this selftest does not really test this series. It
> needs this series to avoid crashing the kernel. What it really tests,
> thanks to kmemleak,

As a net-next follow-up you could force a kmemleak scan and check the
result after each test case to really output a pass/fail message.

Also, still for net-next, please investigate if dropping or reducing the
many sleep below could be possible (it's not clear to me why they are
needed).

I'll take is as-is to avoid blocking the fixes for trivial matters.

Thanks,

Paolo

Re: [PATCH net v2 0/3] net: fix lwtunnel reentry loops

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Fri, 14 Mar 2025 13:00:45 +0100 you wrote:
> v2:
> - removed some patches from the -v1 series
> - added a patch that was initially sent separately
> - code style for the selftest (thanks Paolo)
> v1:
> - https://lore.kernel.org/all/20250311141238.19862-1-justin.iurman@uliege.be/
> 
> [...]

Here is the summary with links:
  - [net,v2,1/3] net: lwtunnel: fix recursion loops
    https://git.kernel.org/netdev/net/c/986ffb3a57c5
  - [net,v2,2/3] net: ipv6: ioam6: fix lwtunnel_output() loop
    https://git.kernel.org/netdev/net/c/3e7a60b368ea
  - [net,v2,3/3] selftests: net: test for lwtunnel dst ref loops
    https://git.kernel.org/netdev/net/c/3ed61b8938c6

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH net v2 3/3] selftests: net: test for lwtunnel dst ref loops

[Justin Iurman]

On 3/20/25 11:25, Paolo Abeni wrote:
> On 3/14/25 1:00 PM, Justin Iurman wrote:
>> As recently specified by commit 0ea09cbf8350 ("docs: netdev: add a note
>> on selftest posting") in net-next, the selftest is therefore shipped in
>> this series. However, this selftest does not really test this series. It
>> needs this series to avoid crashing the kernel. What it really tests,
>> thanks to kmemleak,
> 
> As a net-next follow-up you could force a kmemleak scan and check the
> result after each test case to really output a pass/fail message.

Sure. Could you point me to an example doing that? Not sure how I'd 
force it within the selftest.

> Also, still for net-next, please investigate if dropping or reducing the
> many sleep below could be possible (it's not clear to me why they are
> needed).

Of course, will do.

> I'll take is as-is to avoid blocking the fixes for trivial matters.

Thanks,
Justin

> Thanks,
> 
> Paolo
> 

Re: [PATCH net v2 3/3] selftests: net: test for lwtunnel dst ref loops: manual merge

[Matthieu Baerts]

[-- Attachment #1: Type: text/plain, Size: 3876 bytes --]

Hi Justin,

On 14/03/2025 13:00, Justin Iurman wrote:
> As recently specified by commit 0ea09cbf8350 ("docs: netdev: add a note
> on selftest posting") in net-next, the selftest is therefore shipped in
> this series. However, this selftest does not really test this series. It
> needs this series to avoid crashing the kernel. What it really tests,
> thanks to kmemleak, is what was fixed by the following commits:
> - commit c71a192976de ("net: ipv6: fix dst refleaks in rpl, seg6 and
> ioam6 lwtunnels")
> - commit 92191dd10730 ("net: ipv6: fix dst ref loops in rpl, seg6 and
> ioam6 lwtunnels")
> - commit c64a0727f9b1 ("net: ipv6: fix dst ref loop on input in seg6
> lwt")
> - commit 13e55fbaec17 ("net: ipv6: fix dst ref loop on input in rpl
> lwt")
> - commit 0e7633d7b95b ("net: ipv6: fix dst ref loop in ila lwtunnel")
> - commit 5da15a9c11c1 ("net: ipv6: fix missing dst ref drop in ila
> lwtunnel")
> 
> Signed-off-by: Justin Iurman <justin.iurman@uliege.be>
> ---
> Cc: Shuah Khan <shuah@kernel.org>
> Cc: linux-kselftest@vger.kernel.org
> ---
>  tools/testing/selftests/net/Makefile          |   1 +
>  tools/testing/selftests/net/config            |   2 +
>  .../selftests/net/lwt_dst_cache_ref_loop.sh   | 246 ++++++++++++++++++
>  3 files changed, 249 insertions(+)
>  create mode 100755 tools/testing/selftests/net/lwt_dst_cache_ref_loop.sh
> 
> diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
> index 5916f3b81c39..843ab747645d 100644
> --- a/tools/testing/selftests/net/Makefile
> +++ b/tools/testing/selftests/net/Makefile
> @@ -101,6 +101,7 @@ TEST_PROGS += vlan_bridge_binding.sh
>  TEST_PROGS += bpf_offload.py
>  TEST_PROGS += ipv6_route_update_soft_lockup.sh
>  TEST_PROGS += busy_poll_test.sh
> +TEST_PROGS += lwt_dst_cache_ref_loop.sh
>  
>  # YNL files, must be before "include ..lib.mk"
>  YNL_GEN_FILES := busy_poller netlink-dumps
> diff --git a/tools/testing/selftests/net/config b/tools/testing/selftests/net/config
> index 5b9baf708950..61e5116987f3 100644
> --- a/tools/testing/selftests/net/config
> +++ b/tools/testing/selftests/net/config
> @@ -107,3 +107,5 @@ CONFIG_XFRM_INTERFACE=m
>  CONFIG_XFRM_USER=m
>  CONFIG_IP_NF_MATCH_RPFILTER=m
>  CONFIG_IP6_NF_MATCH_RPFILTER=m
> +CONFIG_IPV6_ILA=m
> +CONFIG_IPV6_RPL_LWTUNNEL=y

FYI, we got a small conflict when merging 'net' in 'net-next' in the
MPTCP tree due to this patch applied in 'net':

 3ed61b8938c6 ("selftests: net: test for lwtunnel dst ref loops")

and these ones from 'net-next':

 03544faad761 ("selftest: net: add proc_net_pktgen")
 85cb3711acb8 ("selftests: net: Add test cases for link and peer netns")

----- Generic Message -----
The best is to avoid conflicts between 'net' and 'net-next' trees but if
they cannot be avoided when preparing patches, a note about how to fix
them is much appreciated.

The conflict has been resolved on our side[1] and the resolution we
suggest is attached to this email. Please report any issues linked to
this conflict resolution as it might be used by others. If you worked on
the mentioned patches, don't hesitate to ACK this conflict resolution.
---------------------------

Regarding these conflicts, that's because the new test and configs have
been added at the end. It is usually recommended to avoid that for long
list, e.g. inserting new entries at the right place if the list is
sorted by alphabetical order (not the case here), grouping by theme, or
keeping the same order as in the .config, etc. For the resolutions here,
I simply kept the new tests and configs from both sides at the same
place, adding the new ones from net at the end.

Rerere cache is available in [2].

Cheers,
Matt

[1] https://github.com/multipath-tcp/mptcp_net-next/commit/89220b9164c7
[2] https://github.com/multipath-tcp/mptcp-upstream-rr-cache/commit/d240

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.

[-- Attachment #2: 89220b9164c70f7aa2d3fafab261bb196f8f3335.patch --]
[-- Type: text/x-patch, Size: 1596 bytes --]

diff --cc tools/testing/selftests/net/Makefile
index f03a0399e7a3,8f32b4f01aee..6d718b478ed8
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@@ -31,15 -31,11 +31,14 @@@ TEST_PROGS += veth.s
  TEST_PROGS += ioam6.sh
  TEST_PROGS += gro.sh
  TEST_PROGS += gre_gso.sh
- TEST_PROGS += gre_ipv6_lladdr.sh
  TEST_PROGS += cmsg_so_mark.sh
  TEST_PROGS += cmsg_so_priority.sh
 -TEST_PROGS += cmsg_time.sh cmsg_ipv6.sh
 +TEST_PROGS += test_so_rcv.sh
 +TEST_PROGS += cmsg_time.sh cmsg_ip.sh
  TEST_PROGS += netns-name.sh
 +TEST_PROGS += link_netns.py
  TEST_PROGS += nl_netdev.py
 +TEST_PROGS += rtnetlink.py
  TEST_PROGS += srv6_end_dt46_l3vpn_test.sh
  TEST_PROGS += srv6_end_dt4_l3vpn_test.sh
  TEST_PROGS += srv6_end_dt6_l3vpn_test.sh
@@@ -105,7 -100,7 +104,8 @@@ TEST_PROGS += vlan_bridge_binding.s
  TEST_PROGS += bpf_offload.py
  TEST_PROGS += ipv6_route_update_soft_lockup.sh
  TEST_PROGS += busy_poll_test.sh
 +TEST_GEN_PROGS += proc_net_pktgen
+ TEST_PROGS += lwt_dst_cache_ref_loop.sh
  
  # YNL files, must be before "include ..lib.mk"
  YNL_GEN_FILES := busy_poller netlink-dumps
diff --cc tools/testing/selftests/net/config
index b0d0eda829d0,61e5116987f3..130d532b7e67
--- a/tools/testing/selftests/net/config
+++ b/tools/testing/selftests/net/config
@@@ -109,9 -107,5 +109,11 @@@ CONFIG_XFRM_INTERFACE=
  CONFIG_XFRM_USER=m
  CONFIG_IP_NF_MATCH_RPFILTER=m
  CONFIG_IP6_NF_MATCH_RPFILTER=m
 +CONFIG_IPVLAN=m
 +CONFIG_CAN=m
 +CONFIG_CAN_DEV=m
 +CONFIG_CAN_VXCAN=m
 +CONFIG_NETKIT=y
 +CONFIG_NET_PKTGEN=m
+ CONFIG_IPV6_ILA=m
+ CONFIG_IPV6_RPL_LWTUNNEL=y

Re: [PATCH net v2 0/3] net: fix lwtunnel reentry loops

[Eduard Zingerman]

Justin Iurman <justin.iurman@uliege.be> writes:

> v2:
> - removed some patches from the -v1 series
> - added a patch that was initially sent separately
> - code style for the selftest (thanks Paolo)
> v1:
> - https://lore.kernel.org/all/20250311141238.19862-1-justin.iurman@uliege.be/

Hi Justin,

I've noticed a BUG splat likely introduced by this patch.
The splat is reported when executing some BPF selftests,
e.g. lwt_ip_encap_ipv4/egress
(defined in tools/testing/selftests/bpf/prog_tests/lwt_ip_encap.c and
            tools/testing/selftests/bpf/progs/test_lwt_ip_encap.c).

Decoded splat is at the end of the email.
Line numbers correspond to commit
a27a97f71394 ("Merge branch 'bpf-support-atomic-update-for-htab-of-maps'")
from the kernel/git/bpf/bpf-next.git tree.

Thanks,
Eduard

---

[  193.993893] BUG: using __this_cpu_add() in preemptible [00000000] code: test_progs/206
[  193.994292] caller is lwtunnel_xmit (net/core/dev.h:340 net/core/lwtunnel.c:408) 
[  193.994601] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[  193.994603] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-4.el9 04/01/2014
[  193.994605] Call Trace:
[  193.994608]  <TASK>
[  193.994611] dump_stack_lvl (lib/dump_stack.c:122) 
[  193.994622] check_preemption_disabled (lib/smp_processor_id.c:0) 
[  193.994630] ? lwtunnel_xmit (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:841 net/core/lwtunnel.c:403) 
[  193.994637] lwtunnel_xmit (net/core/dev.h:340 net/core/lwtunnel.c:408) 
[  193.994648] ip_finish_output2 (net/ipv4/ip_output.c:222) 
[  193.994655] ? ip_skb_dst_mtu (./include/net/ip.h:517) 
[  193.994659] ? ip_skb_dst_mtu (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:841 ./include/net/ip.h:471 ./include/net/ip.h:512) 
[  193.994669] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182) 
[  193.994672] ? __ip_finish_output (net/ipv4/ip_output.c:306) 
[  193.994683] ? __ip_queue_xmit (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:841 net/ipv4/ip_output.c:470) 
[  193.994688] __ip_queue_xmit (net/ipv4/ip_output.c:527) 
[  193.994693] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182) 
[  193.994711] ? __ip_queue_xmit (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:841 net/ipv4/ip_output.c:470) 
[  193.994726] __tcp_transmit_skb (net/ipv4/tcp_output.c:1479) 
[  193.994800] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182) 
[  193.994804] ? __asan_memset (mm/kasan/shadow.c:84) 
[  193.994810] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182) 
[  193.994824] tcp_connect (net/ipv4/tcp_output.c:0 net/ipv4/tcp_output.c:4155) 
[  193.994890] tcp_v4_connect (net/ipv4/tcp_ipv4.c:343) 
[  193.994926] __inet_stream_connect (net/ipv4/af_inet.c:678) 
[  193.994944] ? __local_bh_enable_ip (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 kernel/softirq.c:412) 
[  193.994950] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182) 
[  193.994953] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473) 
[  193.994967] inet_stream_connect (net/ipv4/af_inet.c:748) 
[  193.994976] ? __pfx_inet_stream_connect (net/ipv4/af_inet.c:744) 
[  193.994981] __sys_connect (./include/linux/file.h:62 ./include/linux/file.h:83 net/socket.c:2058) 
[  193.995013] __x64_sys_connect (net/socket.c:2063 net/socket.c:2060 net/socket.c:2060) 
[  193.995022] do_syscall_64 (arch/x86/entry/syscall_64.c:0) 
[  193.995026] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182) 
[  193.995030] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473) 
[  193.995038] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) 
[  193.995042] RIP: 0033:0x7faec2d0f9cb
[ 193.995047] Code: 83 ec 18 89 54 24 0c 48 89 34 24 89 7c 24 08 e8 4b 70 f7 ff 8b 54 24 0c 48 8b 34 24 41 89 c0 8b 7c 24 08 b8 2a 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 08 e8 a1 70 f7 ff 8b 44
All code
========
   0:	83 ec 18             	sub    $0x18,%esp
   3:	89 54 24 0c          	mov    %edx,0xc(%rsp)
   7:	48 89 34 24          	mov    %rsi,(%rsp)
   b:	89 7c 24 08          	mov    %edi,0x8(%rsp)
   f:	e8 4b 70 f7 ff       	call   0xfffffffffff7705f
  14:	8b 54 24 0c          	mov    0xc(%rsp),%edx
  18:	48 8b 34 24          	mov    (%rsp),%rsi
  1c:	41 89 c0             	mov    %eax,%r8d
  1f:	8b 7c 24 08          	mov    0x8(%rsp),%edi
  23:	b8 2a 00 00 00       	mov    $0x2a,%eax
  28:	0f 05                	syscall
  2a:*	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax		<-- trapping instruction
  30:	77 35                	ja     0x67
  32:	44 89 c7             	mov    %r8d,%edi
  35:	89 44 24 08          	mov    %eax,0x8(%rsp)
  39:	e8 a1 70 f7 ff       	call   0xfffffffffff770df
  3e:	8b                   	.byte 0x8b
  3f:	44                   	rex.R

Code starting with the faulting instruction
===========================================
   0:	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax
   6:	77 35                	ja     0x3d
   8:	44 89 c7             	mov    %r8d,%edi
   b:	89 44 24 08          	mov    %eax,0x8(%rsp)
   f:	e8 a1 70 f7 ff       	call   0xfffffffffff770b5
  14:	8b                   	.byte 0x8b
  15:	44                   	rex.R
[  193.995050] RSP: 002b:00007fff992d3a20 EFLAGS: 00000293 ORIG_RAX: 000000000000002a
[  193.995054] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007faec2d0f9cb
[  193.995057] RDX: 0000000000000010 RSI: 00007fff992d3ad8 RDI: 0000000000000035
[  193.995059] RBP: 00007fff992d3ac0 R08: 0000000000000000 R09: 0000000000000004
[  193.995062] R10: 00007fff992d39b0 R11: 0000000000000293 R12: 00007fff992d7b78
[  193.995064] R13: 000000000095f760 R14: 0000000002e38b90 R15: 00007faec373d000
[  193.995091]  </TASK>

Re: [PATCH net v2 0/3] net: fix lwtunnel reentry loops

[Justin Iurman]

On 4/15/25 00:30, Eduard Zingerman wrote:
> Justin Iurman <justin.iurman@uliege.be> writes:
> 
>> v2:
>> - removed some patches from the -v1 series
>> - added a patch that was initially sent separately
>> - code style for the selftest (thanks Paolo)
>> v1:
>> - https://lore.kernel.org/all/20250311141238.19862-1-justin.iurman@uliege.be/
> 
> Hi Justin,
> 
> I've noticed a BUG splat likely introduced by this patch.
> The splat is reported when executing some BPF selftests,
> e.g. lwt_ip_encap_ipv4/egress
> (defined in tools/testing/selftests/bpf/prog_tests/lwt_ip_encap.c and
>              tools/testing/selftests/bpf/progs/test_lwt_ip_encap.c).
> 
> Decoded splat is at the end of the email.
> Line numbers correspond to commit
> a27a97f71394 ("Merge branch 'bpf-support-atomic-update-for-htab-of-maps'")
> from the kernel/git/bpf/bpf-next.git tree.

Hi Eduard,

This is currently discussed in [1]. We have a solution, but no consensus 
on the fix yet.

   [1] 
https://lore.kernel.org/netdev/3cee5141-c525-4e83-830e-bf21828aed51@uliege.be/T/#t

Thanks for the report,
Justin

> Thanks,
> Eduard
> 
> ---
> 
> [  193.993893] BUG: using __this_cpu_add() in preemptible [00000000] code: test_progs/206
> [  193.994292] caller is lwtunnel_xmit (net/core/dev.h:340 net/core/lwtunnel.c:408)
> [  193.994601] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
> [  193.994603] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-4.el9 04/01/2014
> [  193.994605] Call Trace:
> [  193.994608]  <TASK>
> [  193.994611] dump_stack_lvl (lib/dump_stack.c:122)
> [  193.994622] check_preemption_disabled (lib/smp_processor_id.c:0)
> [  193.994630] ? lwtunnel_xmit (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:841 net/core/lwtunnel.c:403)
> [  193.994637] lwtunnel_xmit (net/core/dev.h:340 net/core/lwtunnel.c:408)
> [  193.994648] ip_finish_output2 (net/ipv4/ip_output.c:222)
> [  193.994655] ? ip_skb_dst_mtu (./include/net/ip.h:517)
> [  193.994659] ? ip_skb_dst_mtu (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:841 ./include/net/ip.h:471 ./include/net/ip.h:512)
> [  193.994669] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182)
> [  193.994672] ? __ip_finish_output (net/ipv4/ip_output.c:306)
> [  193.994683] ? __ip_queue_xmit (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:841 net/ipv4/ip_output.c:470)
> [  193.994688] __ip_queue_xmit (net/ipv4/ip_output.c:527)
> [  193.994693] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182)
> [  193.994711] ? __ip_queue_xmit (./include/linux/rcupdate.h:331 ./include/linux/rcupdate.h:841 net/ipv4/ip_output.c:470)
> [  193.994726] __tcp_transmit_skb (net/ipv4/tcp_output.c:1479)
> [  193.994800] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182)
> [  193.994804] ? __asan_memset (mm/kasan/shadow.c:84)
> [  193.994810] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182)
> [  193.994824] tcp_connect (net/ipv4/tcp_output.c:0 net/ipv4/tcp_output.c:4155)
> [  193.994890] tcp_v4_connect (net/ipv4/tcp_ipv4.c:343)
> [  193.994926] __inet_stream_connect (net/ipv4/af_inet.c:678)
> [  193.994944] ? __local_bh_enable_ip (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 kernel/softirq.c:412)
> [  193.994950] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182)
> [  193.994953] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473)
> [  193.994967] inet_stream_connect (net/ipv4/af_inet.c:748)
> [  193.994976] ? __pfx_inet_stream_connect (net/ipv4/af_inet.c:744)
> [  193.994981] __sys_connect (./include/linux/file.h:62 ./include/linux/file.h:83 net/socket.c:2058)
> [  193.995013] __x64_sys_connect (net/socket.c:2063 net/socket.c:2060 net/socket.c:2060)
> [  193.995022] do_syscall_64 (arch/x86/entry/syscall_64.c:0)
> [  193.995026] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:182)
> [  193.995030] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473)
> [  193.995038] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
> [  193.995042] RIP: 0033:0x7faec2d0f9cb
> [ 193.995047] Code: 83 ec 18 89 54 24 0c 48 89 34 24 89 7c 24 08 e8 4b 70 f7 ff 8b 54 24 0c 48 8b 34 24 41 89 c0 8b 7c 24 08 b8 2a 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 08 e8 a1 70 f7 ff 8b 44
> All code
> ========
>     0:	83 ec 18             	sub    $0x18,%esp
>     3:	89 54 24 0c          	mov    %edx,0xc(%rsp)
>     7:	48 89 34 24          	mov    %rsi,(%rsp)
>     b:	89 7c 24 08          	mov    %edi,0x8(%rsp)
>     f:	e8 4b 70 f7 ff       	call   0xfffffffffff7705f
>    14:	8b 54 24 0c          	mov    0xc(%rsp),%edx
>    18:	48 8b 34 24          	mov    (%rsp),%rsi
>    1c:	41 89 c0             	mov    %eax,%r8d
>    1f:	8b 7c 24 08          	mov    0x8(%rsp),%edi
>    23:	b8 2a 00 00 00       	mov    $0x2a,%eax
>    28:	0f 05                	syscall
>    2a:*	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax		<-- trapping instruction
>    30:	77 35                	ja     0x67
>    32:	44 89 c7             	mov    %r8d,%edi
>    35:	89 44 24 08          	mov    %eax,0x8(%rsp)
>    39:	e8 a1 70 f7 ff       	call   0xfffffffffff770df
>    3e:	8b                   	.byte 0x8b
>    3f:	44                   	rex.R
> 
> Code starting with the faulting instruction
> ===========================================
>     0:	48 3d 00 f0 ff ff    	cmp    $0xfffffffffffff000,%rax
>     6:	77 35                	ja     0x3d
>     8:	44 89 c7             	mov    %r8d,%edi
>     b:	89 44 24 08          	mov    %eax,0x8(%rsp)
>     f:	e8 a1 70 f7 ff       	call   0xfffffffffff770b5
>    14:	8b                   	.byte 0x8b
>    15:	44                   	rex.R
> [  193.995050] RSP: 002b:00007fff992d3a20 EFLAGS: 00000293 ORIG_RAX: 000000000000002a
> [  193.995054] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007faec2d0f9cb
> [  193.995057] RDX: 0000000000000010 RSI: 00007fff992d3ad8 RDI: 0000000000000035
> [  193.995059] RBP: 00007fff992d3ac0 R08: 0000000000000000 R09: 0000000000000004
> [  193.995062] R10: 00007fff992d39b0 R11: 0000000000000293 R12: 00007fff992d7b78
> [  193.995064] R13: 000000000095f760 R14: 0000000002e38b90 R15: 00007faec373d000
> [  193.995091]  </TASK>
> 

Re: [PATCH net v2 0/3] net: fix lwtunnel reentry loops

[Eduard Zingerman]

Justin Iurman <justin.iurman@uliege.be> writes:

[...]

> This is currently discussed in [1]. We have a solution, but no
> consensus on the fix yet.
>
>   [1]
>   https://lore.kernel.org/netdev/3cee5141-c525-4e83-830e-bf21828aed51@uliege.be/T/#t

Hi Justin,

Thank you for the link, apologies for the noise.
I didn't look for existing reports properly.

[...]