Commit f5e9ba95 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'net-sched-fix-memory-leak-on-mirred-loop' 

Jamal Hadi Salim says:

====================
net/sched: Fix memory leak on mirred loop

Initialize at_ingress earlier before the if statement.
====================

Link: https://patch.msgid.link/20260101135608.253079-1-jhs@mojatatu.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents d96bfb68 4bcd49a0

net/sched/act_mirred.c

+12 −12
Original line number Diff line number Diff line
@@ -266,11 +266,22 @@ static int tcf_mirred_to_dev(struct sk_buff *skb, struct tcf_mirred *m, 
		goto err_cant_do;

	}



	want_ingress = tcf_mirred_act_wants_ingress(m_eaction);



	at_ingress = skb_at_tc_ingress(skb);

	if (dev == skb->dev && want_ingress == at_ingress) {

		pr_notice_once("tc mirred: Loop (%s:%s --> %s:%s)\n",

			       netdev_name(skb->dev),

			       at_ingress ? "ingress" : "egress",

			       netdev_name(dev),

			       want_ingress ? "ingress" : "egress");

		goto err_cant_do;

	}



	/* we could easily avoid the clone only if called by ingress and clsact;

	 * since we can't easily detect the clsact caller, skip clone only for

	 * ingress - that covers the TC S/W datapath.

	 */

	at_ingress = skb_at_tc_ingress(skb);

	dont_clone = skb_at_tc_ingress(skb) && is_redirect &&

		tcf_mirred_can_reinsert(retval);

	if (!dont_clone) {
@@ -279,17 +290,6 @@ static int tcf_mirred_to_dev(struct sk_buff *skb, struct tcf_mirred *m, 
			goto err_cant_do;

	}



	want_ingress = tcf_mirred_act_wants_ingress(m_eaction);



	if (dev == skb->dev && want_ingress == at_ingress) {

		pr_notice_once("tc mirred: Loop (%s:%s --> %s:%s)\n",

			       netdev_name(skb->dev),

			       at_ingress ? "ingress" : "egress",

			       netdev_name(dev),

			       want_ingress ? "ingress" : "egress");

		goto err_cant_do;

	}



	/* All mirred/redirected skbs should clear previous ct info */

	nf_reset_ct(skb_to_send);

	if (want_ingress && !at_ingress) /* drop dst for egress -> ingress */

tools/testing/selftests/tc-testing/tc-tests/actions/mirred.json

+47 −0
Original line number Diff line number Diff line
@@ -1098,5 +1098,52 @@ 
        "teardown": [

            "$TC qdisc del dev $DUMMY root"

        ]

    },

    {

        "id": "4ed9",

        "name": "Try to redirect to self on egress with clsact",

        "category": [

            "filter",

            "mirred"

        ],

        "plugins": {

            "requires": [

                "nsPlugin"

            ]

        },

        "setup": [

            "$IP link set dev $DUMMY up || true",

            "$IP addr add 10.10.10.10/24 dev $DUMMY || true",

            "$TC qdisc add dev $DUMMY clsact",

            "$TC filter add dev $DUMMY egress protocol ip prio 10 matchall action mirred egress redirect dev $DUMMY index 1"

        ],

        "cmdUnderTest": "ping -c1 -W0.01 -I $DUMMY 10.10.10.1",

        "expExitCode": "1",

        "verifyCmd": "$TC -j -s actions get action mirred index 1",

        "matchJSON": [

            {

                "total acts": 0

            },

            {

                "actions": [

                    {

                        "order": 1,

                        "kind": "mirred",

                        "mirred_action": "redirect",

                        "direction": "egress",

                        "index": 1,

                        "stats": {

                            "packets": 1,

                            "overlimits": 1

                        },

                        "not_in_hw": true

                    }

                ]

            }

        ],

        "teardown": [

            "$TC qdisc del dev $DUMMY clsact"

        ]

    }



]