netdev - [PATCH net-next 1/2] net/sched: act

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251124200825.241037-1-jhs@mojatatu.com>
Date: Mon, 24 Nov 2025 15:08:24 -0500
From: Jamal Hadi Salim <jhs@...atatu.com>
To: davem@...emloft.net,
	kuba@...nel.org,
	edumazet@...gle.com,
	pabeni@...hat.com
Cc: jiri@...nulli.us,
	xiyou.wangcong@...il.com,
	netdev@...r.kernel.org,
	dcaratti@...hat.com,
	Jamal Hadi Salim <jhs@...atatu.com>
Subject: [PATCH net-next 1/2] net/sched: act_mirred: Fix infinite loop

When doing multiport mirroring we dont detect infinite loops.

Example (see the first accompanying tdc test):
packet showing up on port0 ingress mirred redirect --> port1 egress
packet showing up on port1 egress mirred redirect --> port0 ingress

Example 2 (see the second accompanying tdc test)
port0 egress --> port1 ingress --> port0 egress

Fix this by remembering the source dev where mirred ran as opposed to
destination/target dev

Fixes: fe946a751d9b ("net/sched: act_mirred: add loop detection")
Signed-off-by: Jamal Hadi Salim <jhs@...atatu.com>
---
 net/sched/act_mirred.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index f27b583def78..7315179197fd 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -453,7 +453,7 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb,
 		return retval;
 	}
 
-	xmit->sched_mirred_dev[xmit->sched_mirred_nest++] = dev;
+	xmit->sched_mirred_dev[xmit->sched_mirred_nest++] = skb->dev;
 
 	m_mac_header_xmit = READ_ONCE(m->tcfm_mac_header_xmit);
 	m_eaction = READ_ONCE(m->tcfm_eaction);
-- 
2.34.1