Re: [PATCH nft v2] support for afl++ (american fuzzy lop++) fuzzer

[Fernando Fernandez Mancera <fmancera@suse.de>]

On 10/19/25 4:17 PM, Florian Westphal wrote:
>> In addition I noticed that when a kernel splat happens the ruleset that
>> triggered it isn't saved anywhere, it would be nice to save them so we have
>> a reproducer right away.
> 
> I had such code but removed it for this version.
> 
> I can send a followup patch to re-add it but I think that it is better
> for kernel fuzzing to extend knft acordingly, as nft is restricted by
> the input grammar wrt. the nonsense that it can create.
> 

That is fine for me, I still have pending to try knft which I might do 
this week if I have time. If we do not want to save which ruleset 
generated the kernel splat I would drop netlink-rw mode completely..

>> I have a server at home that I am not using.. I would love to automate a
>> script to run this in multiple VMs and generate reports :)
> 
> Yes, that would be good.  Note that I still primarily use it with
> netlink-ro mode to not exercise he kernel, its easy to make graph
> validation (or abort path) take very long to finish.
> 
> There is still a patch series in the queue to limit jumps in nftables
> and I did not yet have time in looking at the abort path, Its simply not
> an issue for normal cases (you assume the input is going to be
> committed...).  But for faster netlink-rw/knft fuzzing it would make
> sense to look into async abort (like we do for commit cleanup).
> 

Yes, it seems we found the same issue. I do not have a solution on the 
control plane although I was about to send this patch for data plane.

diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 6557a4018c09..ddc4943d082c 100644
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -251,10 +251,10 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv)
  {
         const struct nft_chain *chain = priv, *basechain = chain;
         const struct net *net = nft_net(pkt);
+       unsigned int stackptr = 0, jumps = 0;
         const struct nft_expr *expr, *last;
         const struct nft_rule_dp *rule;
         struct nft_regs regs;
-       unsigned int stackptr = 0;
         struct nft_jumpstack jumpstack[NFT_JUMP_STACK_SIZE];
         bool genbit = READ_ONCE(net->nft.gencursor);
         struct nft_rule_blob *blob;
@@ -314,6 +314,9 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv)

         switch (regs.verdict.code) {
         case NFT_JUMP:
+               jumps++;
+               if (WARN_ON_ONCE(jumps > 256))
+                       return NF_DROP;
                 if (WARN_ON_ONCE(stackptr >= NFT_JUMP_STACK_SIZE))
                         return NF_DROP;
                 jumpstack[stackptr].rule = nft_rule_next(rule);

Currently with enough jumps chained together and traffic generated, CPU 
can get stuck on nft_do_chain() triggering a kernel splat. If there is a 
solution on data plane it would be much better than this of course.