Re: [PATCH v2] netfilter: nft_fwd_netdev: use recursion counter in neigh egress path

[Weiming Shi <bestswngs@gmail.com>]

On 26-04-09 13:21, Pablo Neira Ayuso wrote:
> On Thu, Apr 09, 2026 at 01:06:03PM +0200, Pablo Neira Ayuso wrote:
> > On Thu, Apr 09, 2026 at 06:49:12PM +0800, Weiming Shi wrote:
> > > nft_fwd_neigh can be used in egress chains (NF_NETDEV_EGRESS). When the
> > > forwarding rule targets the same device or two devices forward to each
> > > other, neigh_xmit() triggers dev_queue_xmit() which re-enters
> > > nf_hook_egress(), causing infinite recursion and stack overflow.
> > > 
> > > Move the nf_get_nf_dup_skb_recursion() accessor and NF_RECURSION_LIMIT
> > > to the shared header nf_dup_netdev.h as a static inline, so that
> > > nft_fwd_netdev can use the recursion counter directly without exported
> > > function call overhead. Guard neigh_xmit() with the same recursion
> > > limit already used in nf_do_netdev_egress().
> > > 
> > > Fixes: f87b9464d152 ("netfilter: nft_fwd_netdev: Support egress hook")
> > 
> > I would just restrict this "feature", I don't see a point in allowing
> > this from egress?
> 
> Hm, actually this can be combined with if0 device, fixing it makes sense.
> 
> > > Reported-by: Xiang Mei <xmei5@asu.edu>
> > > Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> > > ---
> > >  include/net/netfilter/nf_dup_netdev.h | 13 +++++++++++++
> > >  net/netfilter/nf_dup_netdev.c         | 16 ----------------
> > >  net/netfilter/nft_fwd_netdev.c        |  7 +++++++
> > >  3 files changed, 20 insertions(+), 16 deletions(-)
> > > 
> > > diff --git a/include/net/netfilter/nf_dup_netdev.h b/include/net/netfilter/nf_dup_netdev.h
> > > index b175d271aec9..609bcf422a9b 100644
> > > --- a/include/net/netfilter/nf_dup_netdev.h
> > > +++ b/include/net/netfilter/nf_dup_netdev.h
> > > @@ -3,10 +3,23 @@
> > >  #define _NF_DUP_NETDEV_H_
> > >  
> > >  #include <net/netfilter/nf_tables.h>
> > > +#include <linux/netdevice.h>
> > > +#include <linux/sched.h>
> > >  
> > >  void nf_dup_netdev_egress(const struct nft_pktinfo *pkt, int oif);
> > >  void nf_fwd_netdev_egress(const struct nft_pktinfo *pkt, int oif);
> > >  
> > > +#define NF_RECURSION_LIMIT	2
> > > +
> > > +static inline u8 *nf_get_nf_dup_skb_recursion(void)
> > > +{
> > > +#ifndef CONFIG_PREEMPT_RT
> > > +	return this_cpu_ptr(&softnet_data.xmit.nf_dup_skb_recursion);
> > > +#else
> > > +	return &current->net_xmit.nf_dup_skb_recursion;
> > > +#endif
> > > +}
> > > +
> > >  struct nft_offload_ctx;
> > >  struct nft_flow_rule;
> > >  
> > > diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c
> > > index fab8b9011098..a958a1b0c5be 100644
> > > --- a/net/netfilter/nf_dup_netdev.c
> > > +++ b/net/netfilter/nf_dup_netdev.c
> > > @@ -13,22 +13,6 @@
> > >  #include <net/netfilter/nf_tables_offload.h>
> > >  #include <net/netfilter/nf_dup_netdev.h>
> > >  
> > > -#define NF_RECURSION_LIMIT	2
> > > -
> > > -#ifndef CONFIG_PREEMPT_RT
> > > -static u8 *nf_get_nf_dup_skb_recursion(void)
> > > -{
> > > -	return this_cpu_ptr(&softnet_data.xmit.nf_dup_skb_recursion);
> > > -}
> > > -#else
> > > -
> > > -static u8 *nf_get_nf_dup_skb_recursion(void)
> > > -{
> > > -	return &current->net_xmit.nf_dup_skb_recursion;
> > > -}
> > > -
> > > -#endif
> > > -
> > >  static void nf_do_netdev_egress(struct sk_buff *skb, struct net_device *dev,
> > >  				enum nf_dev_hooks hook)
> > >  {
> > > diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c
> > > index 152a9fb4d23a..492bb599a499 100644
> > > --- a/net/netfilter/nft_fwd_netdev.c
> > > +++ b/net/netfilter/nft_fwd_netdev.c
> > > @@ -141,13 +141,20 @@ static void nft_fwd_neigh_eval(const struct nft_expr *expr,
> > >  		goto out;
> > >  	}
> > >  
> > > +	if (*nf_get_nf_dup_skb_recursion() > NF_RECURSION_LIMIT) {
> > > +		verdict = NF_DROP;
> > > +		goto out;
> > > +	}
> > > +
> > >  	dev = dev_get_by_index_rcu(nft_net(pkt), oif);
> > >  	if (dev == NULL)
> > >  		return;
> > >  
> > >  	skb->dev = dev;
> > >  	skb_clear_tstamp(skb);
> > > +	(*nf_get_nf_dup_skb_recursion())++;
> > >  	neigh_xmit(neigh_table, dev, addr, skb);
> > > +	(*nf_get_nf_dup_skb_recursion())--;
> > >  out:
> > >  	regs->verdict.code = verdict;
> > >  }
> > > -- 
> > > 2.43.0
> > > 
> > > 

Thanks Pablo. So shall I keep v2 as is, or is there anything else you'd 
like me to change?