From: Davide Caratti <dcaratti@redhat.com>

Date: Fri, 20 Jan 2023 18:01:39 +0100

Subject: [PATCH] net/sched: act_mirred: better wording on protection against

 excessive stack growth

References: bsc#1012628

Patch-mainline: 6.2.9

Git-commit: 78dcdffe0418ac8f3f057f26fe71ccf4d8ed851f

[ Upstream commit 78dcdffe0418ac8f3f057f26fe71ccf4d8ed851f ]

with commit e2ca070f89ec ("net: sched: protect against stack overflow in

TC act_mirred"), act_mirred protected itself against excessive stack growth

using per_cpu counter of nested calls to tcf_mirred_act(), and capping it

to MIRRED_RECURSION_LIMIT. However, such protection does not detect

recursion/loops in case the packet is enqueued to the backlog (for example,

when the mirred target device has RPS or skb timestamping enabled). Change

the wording from "recursion" to "nesting" to make it more clear to readers.

CC: Jamal Hadi Salim <jhs@mojatatu.com>

Signed-off-by: Davide Caratti <dcaratti@redhat.com>

Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>

Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>

Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Stable-dep-of: ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress")

Signed-off-by: Sasha Levin <sashal@kernel.org>

Signed-off-by: Jiri Slaby <jslaby@suse.cz>

---

 net/sched/act_mirred.c | 16 ++++++++--------

 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c

index 7284bcea..c8abb513 100644

--- a/net/sched/act_mirred.c

+++ b/net/sched/act_mirred.c

@@ -29,8 +29,8 @@

 static LIST_HEAD(mirred_list);

 static DEFINE_SPINLOCK(mirred_list_lock);

-#define MIRRED_RECURSION_LIMIT    4

-static DEFINE_PER_CPU(unsigned int, mirred_rec_level);

+#define MIRRED_NEST_LIMIT    4

+static DEFINE_PER_CPU(unsigned int, mirred_nest_level);

 static bool tcf_mirred_is_act_redirect(int action)

 {

@@ -226,7 +226,7 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb,

 	struct sk_buff *skb2 = skb;

 	bool m_mac_header_xmit;

 	struct net_device *dev;

-	unsigned int rec_level;

+	unsigned int nest_level;

 	int retval, err = 0;

 	bool use_reinsert;

 	bool want_ingress;

@@ -237,11 +237,11 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb,

 	int mac_len;

 	bool at_nh;

-	rec_level = __this_cpu_inc_return(mirred_rec_level);

-	if (unlikely(rec_level > MIRRED_RECURSION_LIMIT)) {

+	nest_level = __this_cpu_inc_return(mirred_nest_level);

+	if (unlikely(nest_level > MIRRED_NEST_LIMIT)) {

 		net_warn_ratelimited("Packet exceeded mirred recursion limit on dev %s\n",

 				     netdev_name(skb->dev));

-		__this_cpu_dec(mirred_rec_level);

+		__this_cpu_dec(mirred_nest_level);

 		return TC_ACT_SHOT;

 	}

@@ -310,7 +310,7 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb,

 			err = tcf_mirred_forward(want_ingress, skb);

 			if (err)

 				tcf_action_inc_overlimit_qstats(&m->common);

-			__this_cpu_dec(mirred_rec_level);

+			__this_cpu_dec(mirred_nest_level);

 			return TC_ACT_CONSUMED;

 		}

 	}

@@ -322,7 +322,7 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb,

 		if (tcf_mirred_is_act_redirect(m_eaction))

 			retval = TC_ACT_SHOT;

 	}

-	__this_cpu_dec(mirred_rec_level);

+	__this_cpu_dec(mirred_nest_level);

 	return retval;

 }

-- 

2.35.3