• Daniel Borkmann's avatar
    bpf: enforce recursion limit on redirects · a70b506e
    Daniel Borkmann authored
    Respect the stack's xmit_recursion limit for calls into dev_queue_xmit().
    Currently, they are not handeled by the limiter when attached to clsact's
    egress parent, for example, and a buggy program redirecting it to the
    same device again could run into stack overflow eventually. It would be
    good if we could notify an admin to give him a chance to react. We reuse
    xmit_recursion instead of having one private to eBPF, so that the stack's
    current recursion depth will be taken into account as well. Follow-up to
    commit 3896d655 ("bpf: introduce bpf_clone_redirect() helper") and
    27b29f63 ("bpf: add bpf_redirect() helper").
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    a70b506e
dev.c 205 KB