Commit fe946a75 authored by Eric Dumazet's avatar Eric Dumazet Committed by Jakub Kicinski
Browse files

net/sched: act_mirred: add loop detection 



Commit 0f022d32 ("net/sched: Fix mirred deadlock on device recursion")
added code in the fast path, even when act_mirred is not used.

Prepare its revert by implementing loop detection in act_mirred.

Adds an array of device pointers in struct netdev_xmit.

tcf_mirred_is_act_redirect() can detect if the array
already contains the target device.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reviewed-by: default avatarKuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: default avatarToke Høiland-Jørgensen <toke@redhat.com>
Tested-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
Acked-by: default avatarJamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20251014171907.3554413-4-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 5b2b7dec

include/linux/netdevice_xmit.h

+8 −1
Original line number Diff line number Diff line
@@ -2,6 +2,12 @@ 
#ifndef _LINUX_NETDEVICE_XMIT_H

#define _LINUX_NETDEVICE_XMIT_H



#if IS_ENABLED(CONFIG_NET_ACT_MIRRED)

#define MIRRED_NEST_LIMIT	4

#endif



struct net_device;



struct netdev_xmit {

	u16 recursion;

	u8  more;
@@ -10,6 +16,7 @@ struct netdev_xmit { 
#endif

#if IS_ENABLED(CONFIG_NET_ACT_MIRRED)

	u8			sched_mirred_nest;

	struct net_device	*sched_mirred_dev[MIRRED_NEST_LIMIT];

#endif

#if IS_ENABLED(CONFIG_NF_DUP_NETDEV)

	u8 nf_dup_skb_recursion;

net/sched/act_mirred.c

+23 −39
Original line number Diff line number Diff line
@@ -29,31 +29,6 @@ 
static LIST_HEAD(mirred_list);

static DEFINE_SPINLOCK(mirred_list_lock);



#define MIRRED_NEST_LIMIT    4



#ifndef CONFIG_PREEMPT_RT

static u8 tcf_mirred_nest_level_inc_return(void)

{

	return __this_cpu_inc_return(softnet_data.xmit.sched_mirred_nest);

}



static void tcf_mirred_nest_level_dec(void)

{

	__this_cpu_dec(softnet_data.xmit.sched_mirred_nest);

}



#else

static u8 tcf_mirred_nest_level_inc_return(void)

{

	return current->net_xmit.sched_mirred_nest++;

}



static void tcf_mirred_nest_level_dec(void)

{

	current->net_xmit.sched_mirred_nest--;

}

#endif



static bool tcf_mirred_is_act_redirect(int action)

{

	return action == TCA_EGRESS_REDIR || action == TCA_INGRESS_REDIR;
@@ -439,44 +414,53 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb, 
{

	struct tcf_mirred *m = to_mirred(a);

	int retval = READ_ONCE(m->tcf_action);

	unsigned int nest_level;

	struct netdev_xmit *xmit;

	bool m_mac_header_xmit;

	struct net_device *dev;

	int m_eaction;

	int i, m_eaction;

	u32 blockid;



	nest_level = tcf_mirred_nest_level_inc_return();

	if (unlikely(nest_level > MIRRED_NEST_LIMIT)) {

#ifdef CONFIG_PREEMPT_RT

	xmit = &current->net_xmit;

#else

	xmit = this_cpu_ptr(&softnet_data.xmit);

#endif

	if (unlikely(xmit->sched_mirred_nest >= MIRRED_NEST_LIMIT)) {

		net_warn_ratelimited("Packet exceeded mirred recursion limit on dev %s\n",

				     netdev_name(skb->dev));

		retval = TC_ACT_SHOT;

		goto dec_nest_level;

		return TC_ACT_SHOT;

	}



	tcf_lastuse_update(&m->tcf_tm);

	tcf_action_update_bstats(&m->common, skb);



	blockid = READ_ONCE(m->tcfm_blockid);

	if (blockid) {

		retval = tcf_blockcast(skb, m, blockid, res, retval);

		goto dec_nest_level;

	}

	if (blockid)

		return tcf_blockcast(skb, m, blockid, res, retval);



	dev = rcu_dereference_bh(m->tcfm_dev);

	if (unlikely(!dev)) {

		pr_notice_once("tc mirred: target device is gone\n");

		tcf_action_inc_overlimit_qstats(&m->common);

		goto dec_nest_level;

		return retval;

	}

	for (i = 0; i < xmit->sched_mirred_nest; i++) {

		if (xmit->sched_mirred_dev[i] != dev)

			continue;

		pr_notice_once("tc mirred: loop on device %s\n",

			       netdev_name(dev));

		tcf_action_inc_overlimit_qstats(&m->common);

		return retval;

	}



	xmit->sched_mirred_dev[xmit->sched_mirred_nest++] = dev;



	m_mac_header_xmit = READ_ONCE(m->tcfm_mac_header_xmit);

	m_eaction = READ_ONCE(m->tcfm_eaction);



	retval = tcf_mirred_to_dev(skb, m, dev, m_mac_header_xmit, m_eaction,

				   retval);



dec_nest_level:

	tcf_mirred_nest_level_dec();

	xmit->sched_mirred_nest--;



	return retval;

}