diff options
| author | Daniel Borkmann <daniel@iogearbox.net> | 2016-06-10 21:19:06 +0200 |
|---|---|---|
| committer | Michael Bestas <mkbestas@lineageos.org> | 2022-04-19 00:50:38 +0300 |
| commit | e68e305a718bb60c49516e9caae1721d7d7b88d8 (patch) | |
| tree | 805e491896d713ffda19e2b827cb211687f4453d /net/core/dev.c | |
| parent | 51cc524947066bd33d2df6e1b776b1a1b7f8d5b9 (diff) | |
bpf: enforce recursion limit on redirects
Respect the stack's xmit_recursion limit for calls into dev_queue_xmit().
Currently, they are not handeled by the limiter when attached to clsact's
egress parent, for example, and a buggy program redirecting it to the
same device again could run into stack overflow eventually. It would be
good if we could notify an admin to give him a chance to react. We reuse
xmit_recursion instead of having one private to eBPF, so that the stack's
current recursion depth will be taken into account as well. Follow-up to
commit 3896d655f4d4 ("bpf: introduce bpf_clone_redirect() helper") and
27b29f63058d ("bpf: add bpf_redirect() helper").
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chatur27 <jasonbright2709@gmail.com>
Diffstat (limited to 'net/core/dev.c')
| -rw-r--r-- | net/core/dev.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/net/core/dev.c b/net/core/dev.c index c205193cab2f..ce24aca94a62 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3023,8 +3023,6 @@ static void skb_update_prio(struct sk_buff *skb) DEFINE_PER_CPU(int, xmit_recursion); EXPORT_SYMBOL(xmit_recursion); -#define RECURSION_LIMIT 8 - /** * dev_loopback_xmit - loop back @skb * @net: network namespace this loopback is happening in @@ -3216,8 +3214,8 @@ static int __dev_queue_xmit(struct sk_buff *skb, void *accel_priv) int cpu = smp_processor_id(); /* ok because BHs are off */ if (txq->xmit_lock_owner != cpu) { - - if (__this_cpu_read(xmit_recursion) > RECURSION_LIMIT) + if (unlikely(__this_cpu_read(xmit_recursion) > + XMIT_RECURSION_LIMIT)) goto recursion_alert; skb = validate_xmit_skb(skb, dev); |