* [PATCH v2] netfilter: nft_fwd_netdev: use recursion counter in neigh egress path
@ 2026-04-09 10:49 Weiming Shi
2026-04-09 11:05 ` Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: Weiming Shi @ 2026-04-09 10:49 UTC (permalink / raw)
To: Pablo Neira Ayuso, Florian Westphal, David S . Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni
Cc: Phil Sutter, Simon Horman, netfilter-devel, coreteam, netdev,
Xiang Mei, Weiming Shi
nft_fwd_neigh can be used in egress chains (NF_NETDEV_EGRESS). When the
forwarding rule targets the same device or two devices forward to each
other, neigh_xmit() triggers dev_queue_xmit() which re-enters
nf_hook_egress(), causing infinite recursion and stack overflow.
Move the nf_get_nf_dup_skb_recursion() accessor and NF_RECURSION_LIMIT
to the shared header nf_dup_netdev.h as a static inline, so that
nft_fwd_netdev can use the recursion counter directly without exported
function call overhead. Guard neigh_xmit() with the same recursion
limit already used in nf_do_netdev_egress().
Fixes: f87b9464d152 ("netfilter: nft_fwd_netdev: Support egress hook")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
include/net/netfilter/nf_dup_netdev.h | 13 +++++++++++++
net/netfilter/nf_dup_netdev.c | 16 ----------------
net/netfilter/nft_fwd_netdev.c | 7 +++++++
3 files changed, 20 insertions(+), 16 deletions(-)
diff --git a/include/net/netfilter/nf_dup_netdev.h b/include/net/netfilter/nf_dup_netdev.h
index b175d271aec9..609bcf422a9b 100644
--- a/include/net/netfilter/nf_dup_netdev.h
+++ b/include/net/netfilter/nf_dup_netdev.h
@@ -3,10 +3,23 @@
#define _NF_DUP_NETDEV_H_
#include <net/netfilter/nf_tables.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif);
void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif);
+#define NF_RECURSION_LIMIT 2
+
+static inline u8 *nf_get_nf_dup_skb_recursion(void)
+{
+#ifndef CONFIG_PREEMPT_RT
+ return this_cpu_ptr(&softnet_data.xmit.nf_dup_skb_recursion);
+#else
+ return ¤t->net_xmit.nf_dup_skb_recursion;
+#endif
+}
+
struct nft_offload_ctx;
struct nft_flow_rule;
diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
index fab8b9011098..a958a1b0c5be 100644
--- a/net/netfilter/nf_dup_netdev.c
+++ b/net/netfilter/nf_dup_netdev.c
@@ -13,22 +13,6 @@
#include <net/netfilter/nf_tables_offload.h>
#include <net/netfilter/nf_dup_netdev.h>
-#define NF_RECURSION_LIMIT 2
-
-#ifndef CONFIG_PREEMPT_RT
-static u8 *nf_get_nf_dup_skb_recursion(void)
-{
- return this_cpu_ptr(&softnet_data.xmit.nf_dup_skb_recursion);
-}
-#else
-
-static u8 *nf_get_nf_dup_skb_recursion(void)
-{
- return ¤t->net_xmit.nf_dup_skb_recursion;
-}
-
-#endif
-
static void nf_do_netdev_egress(struct sk_buff *skb, struct net_device *dev,
enum nf_dev_hooks hook)
{
diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
index 152a9fb4d23a..492bb599a499 100644
--- a/net/netfilter/nft_fwd_netdev.c
+++ b/net/netfilter/nft_fwd_netdev.c
@@ -141,13 +141,20 @@ static void nft_fwd_neigh_eval(const struct nft_expr *expr,
goto out;
}
+ if (*nf_get_nf_dup_skb_recursion() > NF_RECURSION_LIMIT) {
+ verdict = NF_DROP;
+ goto out;
+ }
+
dev = dev_get_by_index_rcu(nft_net(pkt), oif);
if (dev == NULL)
return;
skb->dev = dev;
skb_clear_tstamp(skb);
+ (*nf_get_nf_dup_skb_recursion())++;
neigh_xmit(neigh_table, dev, addr, skb);
+ (*nf_get_nf_dup_skb_recursion())--;
out:
regs->verdict.code = verdict;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH v2] netfilter: nft_fwd_netdev: use recursion counter in neigh egress path
2026-04-09 10:49 [PATCH v2] netfilter: nft_fwd_netdev: use recursion counter in neigh egress path Weiming Shi
@ 2026-04-09 11:05 ` Pablo Neira Ayuso
2026-04-09 11:21 ` Pablo Neira Ayuso
0 siblings, 1 reply; 4+ messages in thread
From: Pablo Neira Ayuso @ 2026-04-09 11:05 UTC (permalink / raw)
To: Weiming Shi
Cc: Florian Westphal, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Phil Sutter, Simon Horman, netfilter-devel, coreteam,
netdev, Xiang Mei
On Thu, Apr 09, 2026 at 06:49:12PM +0800, Weiming Shi wrote:
> nft_fwd_neigh can be used in egress chains (NF_NETDEV_EGRESS). When the
> forwarding rule targets the same device or two devices forward to each
> other, neigh_xmit() triggers dev_queue_xmit() which re-enters
> nf_hook_egress(), causing infinite recursion and stack overflow.
>
> Move the nf_get_nf_dup_skb_recursion() accessor and NF_RECURSION_LIMIT
> to the shared header nf_dup_netdev.h as a static inline, so that
> nft_fwd_netdev can use the recursion counter directly without exported
> function call overhead. Guard neigh_xmit() with the same recursion
> limit already used in nf_do_netdev_egress().
>
> Fixes: f87b9464d152 ("netfilter: nft_fwd_netdev: Support egress hook")
I would just restrict this "feature", I don't see a point in allowing
this from egress?
> Reported-by: Xiang Mei <xmei5@asu.edu>
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> ---
> include/net/netfilter/nf_dup_netdev.h | 13 +++++++++++++
> net/netfilter/nf_dup_netdev.c | 16 ----------------
> net/netfilter/nft_fwd_netdev.c | 7 +++++++
> 3 files changed, 20 insertions(+), 16 deletions(-)
>
> diff --git a/include/net/netfilter/nf_dup_netdev.h b/include/net/netfilter/nf_dup_netdev.h
> index b175d271aec9..609bcf422a9b 100644
> --- a/include/net/netfilter/nf_dup_netdev.h
> +++ b/include/net/netfilter/nf_dup_netdev.h
> @@ -3,10 +3,23 @@
> #define _NF_DUP_NETDEV_H_
>
> #include <net/netfilter/nf_tables.h>
> +#include <linux/netdevice.h>
> +#include <linux/sched.h>
>
> void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif);
> void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif);
>
> +#define NF_RECURSION_LIMIT 2
> +
> +static inline u8 *nf_get_nf_dup_skb_recursion(void)
> +{
> +#ifndef CONFIG_PREEMPT_RT
> + return this_cpu_ptr(&softnet_data.xmit.nf_dup_skb_recursion);
> +#else
> + return ¤t->net_xmit.nf_dup_skb_recursion;
> +#endif
> +}
> +
> struct nft_offload_ctx;
> struct nft_flow_rule;
>
> diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
> index fab8b9011098..a958a1b0c5be 100644
> --- a/net/netfilter/nf_dup_netdev.c
> +++ b/net/netfilter/nf_dup_netdev.c
> @@ -13,22 +13,6 @@
> #include <net/netfilter/nf_tables_offload.h>
> #include <net/netfilter/nf_dup_netdev.h>
>
> -#define NF_RECURSION_LIMIT 2
> -
> -#ifndef CONFIG_PREEMPT_RT
> -static u8 *nf_get_nf_dup_skb_recursion(void)
> -{
> - return this_cpu_ptr(&softnet_data.xmit.nf_dup_skb_recursion);
> -}
> -#else
> -
> -static u8 *nf_get_nf_dup_skb_recursion(void)
> -{
> - return ¤t->net_xmit.nf_dup_skb_recursion;
> -}
> -
> -#endif
> -
> static void nf_do_netdev_egress(struct sk_buff *skb, struct net_device *dev,
> enum nf_dev_hooks hook)
> {
> diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
> index 152a9fb4d23a..492bb599a499 100644
> --- a/net/netfilter/nft_fwd_netdev.c
> +++ b/net/netfilter/nft_fwd_netdev.c
> @@ -141,13 +141,20 @@ static void nft_fwd_neigh_eval(const struct nft_expr *expr,
> goto out;
> }
>
> + if (*nf_get_nf_dup_skb_recursion() > NF_RECURSION_LIMIT) {
> + verdict = NF_DROP;
> + goto out;
> + }
> +
> dev = dev_get_by_index_rcu(nft_net(pkt), oif);
> if (dev == NULL)
> return;
>
> skb->dev = dev;
> skb_clear_tstamp(skb);
> + (*nf_get_nf_dup_skb_recursion())++;
> neigh_xmit(neigh_table, dev, addr, skb);
> + (*nf_get_nf_dup_skb_recursion())--;
> out:
> regs->verdict.code = verdict;
> }
> --
> 2.43.0
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v2] netfilter: nft_fwd_netdev: use recursion counter in neigh egress path
2026-04-09 11:05 ` Pablo Neira Ayuso
@ 2026-04-09 11:21 ` Pablo Neira Ayuso
2026-04-09 15:06 ` Weiming Shi
0 siblings, 1 reply; 4+ messages in thread
From: Pablo Neira Ayuso @ 2026-04-09 11:21 UTC (permalink / raw)
To: Weiming Shi
Cc: Florian Westphal, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Phil Sutter, Simon Horman, netfilter-devel, coreteam,
netdev, Xiang Mei
On Thu, Apr 09, 2026 at 01:06:03PM +0200, Pablo Neira Ayuso wrote:
> On Thu, Apr 09, 2026 at 06:49:12PM +0800, Weiming Shi wrote:
> > nft_fwd_neigh can be used in egress chains (NF_NETDEV_EGRESS). When the
> > forwarding rule targets the same device or two devices forward to each
> > other, neigh_xmit() triggers dev_queue_xmit() which re-enters
> > nf_hook_egress(), causing infinite recursion and stack overflow.
> >
> > Move the nf_get_nf_dup_skb_recursion() accessor and NF_RECURSION_LIMIT
> > to the shared header nf_dup_netdev.h as a static inline, so that
> > nft_fwd_netdev can use the recursion counter directly without exported
> > function call overhead. Guard neigh_xmit() with the same recursion
> > limit already used in nf_do_netdev_egress().
> >
> > Fixes: f87b9464d152 ("netfilter: nft_fwd_netdev: Support egress hook")
>
> I would just restrict this "feature", I don't see a point in allowing
> this from egress?
Hm, actually this can be combined with if0 device, fixing it makes sense.
> > Reported-by: Xiang Mei <xmei5@asu.edu>
> > Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> > ---
> > include/net/netfilter/nf_dup_netdev.h | 13 +++++++++++++
> > net/netfilter/nf_dup_netdev.c | 16 ----------------
> > net/netfilter/nft_fwd_netdev.c | 7 +++++++
> > 3 files changed, 20 insertions(+), 16 deletions(-)
> >
> > diff --git a/include/net/netfilter/nf_dup_netdev.h b/include/net/netfilter/nf_dup_netdev.h
> > index b175d271aec9..609bcf422a9b 100644
> > --- a/include/net/netfilter/nf_dup_netdev.h
> > +++ b/include/net/netfilter/nf_dup_netdev.h
> > @@ -3,10 +3,23 @@
> > #define _NF_DUP_NETDEV_H_
> >
> > #include <net/netfilter/nf_tables.h>
> > +#include <linux/netdevice.h>
> > +#include <linux/sched.h>
> >
> > void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif);
> > void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif);
> >
> > +#define NF_RECURSION_LIMIT 2
> > +
> > +static inline u8 *nf_get_nf_dup_skb_recursion(void)
> > +{
> > +#ifndef CONFIG_PREEMPT_RT
> > + return this_cpu_ptr(&softnet_data.xmit.nf_dup_skb_recursion);
> > +#else
> > + return ¤t->net_xmit.nf_dup_skb_recursion;
> > +#endif
> > +}
> > +
> > struct nft_offload_ctx;
> > struct nft_flow_rule;
> >
> > diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
> > index fab8b9011098..a958a1b0c5be 100644
> > --- a/net/netfilter/nf_dup_netdev.c
> > +++ b/net/netfilter/nf_dup_netdev.c
> > @@ -13,22 +13,6 @@
> > #include <net/netfilter/nf_tables_offload.h>
> > #include <net/netfilter/nf_dup_netdev.h>
> >
> > -#define NF_RECURSION_LIMIT 2
> > -
> > -#ifndef CONFIG_PREEMPT_RT
> > -static u8 *nf_get_nf_dup_skb_recursion(void)
> > -{
> > - return this_cpu_ptr(&softnet_data.xmit.nf_dup_skb_recursion);
> > -}
> > -#else
> > -
> > -static u8 *nf_get_nf_dup_skb_recursion(void)
> > -{
> > - return ¤t->net_xmit.nf_dup_skb_recursion;
> > -}
> > -
> > -#endif
> > -
> > static void nf_do_netdev_egress(struct sk_buff *skb, struct net_device *dev,
> > enum nf_dev_hooks hook)
> > {
> > diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
> > index 152a9fb4d23a..492bb599a499 100644
> > --- a/net/netfilter/nft_fwd_netdev.c
> > +++ b/net/netfilter/nft_fwd_netdev.c
> > @@ -141,13 +141,20 @@ static void nft_fwd_neigh_eval(const struct nft_expr *expr,
> > goto out;
> > }
> >
> > + if (*nf_get_nf_dup_skb_recursion() > NF_RECURSION_LIMIT) {
> > + verdict = NF_DROP;
> > + goto out;
> > + }
> > +
> > dev = dev_get_by_index_rcu(nft_net(pkt), oif);
> > if (dev == NULL)
> > return;
> >
> > skb->dev = dev;
> > skb_clear_tstamp(skb);
> > + (*nf_get_nf_dup_skb_recursion())++;
> > neigh_xmit(neigh_table, dev, addr, skb);
> > + (*nf_get_nf_dup_skb_recursion())--;
> > out:
> > regs->verdict.code = verdict;
> > }
> > --
> > 2.43.0
> >
> >
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v2] netfilter: nft_fwd_netdev: use recursion counter in neigh egress path
2026-04-09 11:21 ` Pablo Neira Ayuso
@ 2026-04-09 15:06 ` Weiming Shi
0 siblings, 0 replies; 4+ messages in thread
From: Weiming Shi @ 2026-04-09 15:06 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: Florian Westphal, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Phil Sutter, Simon Horman, netfilter-devel, coreteam,
netdev, Xiang Mei
On 26-04-09 13:21, Pablo Neira Ayuso wrote:
> On Thu, Apr 09, 2026 at 01:06:03PM +0200, Pablo Neira Ayuso wrote:
> > On Thu, Apr 09, 2026 at 06:49:12PM +0800, Weiming Shi wrote:
> > > nft_fwd_neigh can be used in egress chains (NF_NETDEV_EGRESS). When the
> > > forwarding rule targets the same device or two devices forward to each
> > > other, neigh_xmit() triggers dev_queue_xmit() which re-enters
> > > nf_hook_egress(), causing infinite recursion and stack overflow.
> > >
> > > Move the nf_get_nf_dup_skb_recursion() accessor and NF_RECURSION_LIMIT
> > > to the shared header nf_dup_netdev.h as a static inline, so that
> > > nft_fwd_netdev can use the recursion counter directly without exported
> > > function call overhead. Guard neigh_xmit() with the same recursion
> > > limit already used in nf_do_netdev_egress().
> > >
> > > Fixes: f87b9464d152 ("netfilter: nft_fwd_netdev: Support egress hook")
> >
> > I would just restrict this "feature", I don't see a point in allowing
> > this from egress?
>
> Hm, actually this can be combined with if0 device, fixing it makes sense.
>
> > > Reported-by: Xiang Mei <xmei5@asu.edu>
> > > Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> > > ---
> > > include/net/netfilter/nf_dup_netdev.h | 13 +++++++++++++
> > > net/netfilter/nf_dup_netdev.c | 16 ----------------
> > > net/netfilter/nft_fwd_netdev.c | 7 +++++++
> > > 3 files changed, 20 insertions(+), 16 deletions(-)
> > >
> > > diff --git a/include/net/netfilter/nf_dup_netdev.h b/include/net/netfilter/nf_dup_netdev.h
> > > index b175d271aec9..609bcf422a9b 100644
> > > --- a/include/net/netfilter/nf_dup_netdev.h
> > > +++ b/include/net/netfilter/nf_dup_netdev.h
> > > @@ -3,10 +3,23 @@
> > > #define _NF_DUP_NETDEV_H_
> > >
> > > #include <net/netfilter/nf_tables.h>
> > > +#include <linux/netdevice.h>
> > > +#include <linux/sched.h>
> > >
> > > void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif);
> > > void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif);
> > >
> > > +#define NF_RECURSION_LIMIT 2
> > > +
> > > +static inline u8 *nf_get_nf_dup_skb_recursion(void)
> > > +{
> > > +#ifndef CONFIG_PREEMPT_RT
> > > + return this_cpu_ptr(&softnet_data.xmit.nf_dup_skb_recursion);
> > > +#else
> > > + return ¤t->net_xmit.nf_dup_skb_recursion;
> > > +#endif
> > > +}
> > > +
> > > struct nft_offload_ctx;
> > > struct nft_flow_rule;
> > >
> > > diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
> > > index fab8b9011098..a958a1b0c5be 100644
> > > --- a/net/netfilter/nf_dup_netdev.c
> > > +++ b/net/netfilter/nf_dup_netdev.c
> > > @@ -13,22 +13,6 @@
> > > #include <net/netfilter/nf_tables_offload.h>
> > > #include <net/netfilter/nf_dup_netdev.h>
> > >
> > > -#define NF_RECURSION_LIMIT 2
> > > -
> > > -#ifndef CONFIG_PREEMPT_RT
> > > -static u8 *nf_get_nf_dup_skb_recursion(void)
> > > -{
> > > - return this_cpu_ptr(&softnet_data.xmit.nf_dup_skb_recursion);
> > > -}
> > > -#else
> > > -
> > > -static u8 *nf_get_nf_dup_skb_recursion(void)
> > > -{
> > > - return ¤t->net_xmit.nf_dup_skb_recursion;
> > > -}
> > > -
> > > -#endif
> > > -
> > > static void nf_do_netdev_egress(struct sk_buff *skb, struct net_device *dev,
> > > enum nf_dev_hooks hook)
> > > {
> > > diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
> > > index 152a9fb4d23a..492bb599a499 100644
> > > --- a/net/netfilter/nft_fwd_netdev.c
> > > +++ b/net/netfilter/nft_fwd_netdev.c
> > > @@ -141,13 +141,20 @@ static void nft_fwd_neigh_eval(const struct nft_expr *expr,
> > > goto out;
> > > }
> > >
> > > + if (*nf_get_nf_dup_skb_recursion() > NF_RECURSION_LIMIT) {
> > > + verdict = NF_DROP;
> > > + goto out;
> > > + }
> > > +
> > > dev = dev_get_by_index_rcu(nft_net(pkt), oif);
> > > if (dev == NULL)
> > > return;
> > >
> > > skb->dev = dev;
> > > skb_clear_tstamp(skb);
> > > + (*nf_get_nf_dup_skb_recursion())++;
> > > neigh_xmit(neigh_table, dev, addr, skb);
> > > + (*nf_get_nf_dup_skb_recursion())--;
> > > out:
> > > regs->verdict.code = verdict;
> > > }
> > > --
> > > 2.43.0
> > >
> > >
Thanks Pablo. So shall I keep v2 as is, or is there anything else you'd
like me to change?
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-04-09 15:06 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-09 10:49 [PATCH v2] netfilter: nft_fwd_netdev: use recursion counter in neigh egress path Weiming Shi
2026-04-09 11:05 ` Pablo Neira Ayuso
2026-04-09 11:21 ` Pablo Neira Ayuso
2026-04-09 15:06 ` Weiming Shi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox