[PATCH nf] netfilter: nft_fwd_netdev: use recursion counter in neigh egress path

Weiming Shi
2026-04-09T05:38:38Z

nft_fwd_neigh_eval() can be attached to NF_NETDEV_EGRESS chains since
commit f87b9464d152 ("netfilter: nft_fwd_netdev: Support egress hook").
When a forwarding rule targets the same device (or two devices forward
to each other), the evaluator calls neigh_xmit() which reaches
dev_queue_xmit(), re-entering nf_hook_egress() before the previous
invocation returns. This recurses until the kernel stack is exhausted.

The nf_dup_skb_recursion counter in nf_do_netdev_egress() was added by
commit fcd53c51d037 ("netfilter: nf_dup_netdev: add and use recursion
counter") to prevent exactly this class of bug, but nft_fwd_neigh_eval()
bypasses that helper entirely by calling neigh_xmit() directly.

BUG: KASAN: slab-out-of-bounds in nft_do_chain (net/netfilter/nf_tables_core.c:287)
Call Trace:
nft_do_chain (net/netfilter/nf_tables_core.c:287)
nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:289)
nf_hook_slow (include/linux/netfilter.h:158)
__dev_queue_xmit (net/core/dev.c:4807)
neigh_resolve_output (include/linux/seqlock.h:392)
neigh_xmit (net/core/neighbour.c:3230)
nft_fwd_neigh_eval (net/netfilter/nft_fwd_netdev.c:150)
nft_do_chain (net/netfilter/nf_tables_core.c:287)
nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:289)
nf_hook_slow (include/linux/netfilter.h:158)
__dev_queue_xmit (net/core/dev.c:4807)
[repeats until stack exhaustion]

Kernel panic - not syncing: Fatal exception in interrupt

Export the recursion counter helpers from nf_dup_netdev and use them
in nft_fwd_neigh_eval() to bound the recursion depth, matching the
protection already present in nf_do_netdev_egress().

Fixes: f87b9464d152 ("netfilter: nft_fwd_netdev: Support egress hook")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
include/net/netfilter/nf_dup_netdev.h | 4 ++++
net/netfilter/nf_dup_netdev.c | 18 ++++++++++++++++++
net/netfilter/nft_fwd_netdev.c | 7 +++++++
3 files changed, 29 insertions(+)

diff --git a/include/net/netfilter/nf_dup_netdev.h b/include/net/netfilter/nf_dup_netdev.h
index b175d271aec9..17362f76d1d1 100644
--- a/include/net/netfilter/nf_dup_netdev.h
+++ b/include/net/netfilter/nf_dup_netdev.h
@@ -7,6 +7,10 @@
void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif);
void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif);

+bool nf_dup_netdev_has_recursed(void);
+void nf_dup_netdev_recursion_inc(void);
+void nf_dup_netdev_recursion_dec(void);
+
struct nft_offload_ctx;
struct nft_flow_rule;

diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
index fab8b9011098..e2fe8bb6fe0d 100644
--- a/net/netfilter/nf_dup_netdev.c
+++ b/net/netfilter/nf_dup_netdev.c
@@ -29,6 +29,24 @@ static u8 *nf_get_nf_dup_skb_recursion(void)

#endif

+bool nf_dup_netdev_has_recursed(void)
+{
+ return *nf_get_nf_dup_skb_recursion() > NF_RECURSION_LIMIT;
+}
+EXPORT_SYMBOL_GPL(nf_dup_netdev_has_recursed);
+
+void nf_dup_netdev_recursion_inc(void)
+{
+ (*nf_get_nf_dup_skb_recursion())++;
+}
+EXPORT_SYMBOL_GPL(nf_dup_netdev_recursion_inc);
+
+void nf_dup_netdev_recursion_dec(void)
+{
+ (*nf_get_nf_dup_skb_recursion())--;
+}
+EXPORT_SYMBOL_GPL(nf_dup_netdev_recursion_dec);
+
static void nf_do_netdev_egress(struct sk_buff *skb, struct net_device *dev,
enum nf_dev_hooks hook)
{
diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
index 152a9fb4d23a..d85f72af3589 100644
--- a/net/netfilter/nft_fwd_netdev.c
+++ b/net/netfilter/nft_fwd_netdev.c
@@ -141,13 +141,20 @@ static void nft_fwd_neigh_eval(const struct nft_expr *expr,
goto out;
}

+ if (nf_dup_netdev_has_recursed()) {
+ verdict = NF_DROP;
+ goto out;
+ }
+
dev = dev_get_by_index_rcu(nft_net(pkt), oif);
if (dev == NULL)
return;

skb->dev = dev;
skb_clear_tstamp(skb);
+ nf_dup_netdev_recursion_inc();
neigh_xmit(neigh_table, dev, addr, skb);
+ nf_dup_netdev_recursion_dec();
out:
regs->verdict.code = verdict;
}
--
2.43.0