Re: [PATCH net-next 2/2] net: sched: protect against stack overflow in TC act_mirred

2019-06-25 Thread Eyal Birger
Hi Jamal, John, On Tue, 25 Jun 2019 07:24:37 -0400 Jamal Hadi Salim wrote: > On 2019-06-25 5:06 a.m., John Hurley wrote: > > On Tue, Jun 25, 2019 at 9:30 AM Eyal Birger > > wrote: > > > I'm not sure on the history of why a value of 4 was selected here > > but it seems to fall into line with

Re: [PATCH net-next 2/2] net: sched: protect against stack overflow in TC act_mirred

2019-06-25 Thread Jamal Hadi Salim
On 2019-06-25 5:06 a.m., John Hurley wrote: On Tue, Jun 25, 2019 at 9:30 AM Eyal Birger wrote: I'm not sure on the history of why a value of 4 was selected here but it seems to fall into line with my findings. Back then we could only loop in one direction (as opposed to two right now) - so

Re: [PATCH net-next 2/2] net: sched: protect against stack overflow in TC act_mirred

2019-06-25 Thread John Hurley
On Tue, Jun 25, 2019 at 10:15 AM Florian Westphal wrote: > > John Hurley wrote: > > Hi Eyal, > > The value of 4 is basically a revert to what it was on older kernels > > when TC had a TTL value in the skb: > > https://elixir.bootlin.com/linux/v3.19.8/source/include/uapi/linux/pkt_cls.h#L97 > > II

Re: [PATCH net-next 2/2] net: sched: protect against stack overflow in TC act_mirred

2019-06-25 Thread Florian Westphal
John Hurley wrote: > Hi Eyal, > The value of 4 is basically a revert to what it was on older kernels > when TC had a TTL value in the skb: > https://elixir.bootlin.com/linux/v3.19.8/source/include/uapi/linux/pkt_cls.h#L97 IIRC this TTL value was not used ever. > I also found with my testing that

Re: [PATCH net-next 2/2] net: sched: protect against stack overflow in TC act_mirred

2019-06-25 Thread John Hurley
On Tue, Jun 25, 2019 at 9:30 AM Eyal Birger wrote: > > Hi John, > > On Mon, 24 Jun 2019 23:13:36 +0100 > John Hurley wrote: > > > TC hooks allow the application of filters and actions to packets at > > both ingress and egress of the network stack. It is possible, with > > poor configuration, that

Re: [PATCH net-next 2/2] net: sched: protect against stack overflow in TC act_mirred

2019-06-25 Thread Eyal Birger
Hi John, On Mon, 24 Jun 2019 23:13:36 +0100 John Hurley wrote: > TC hooks allow the application of filters and actions to packets at > both ingress and egress of the network stack. It is possible, with > poor configuration, that this can produce loops whereby an ingress > hook calls a mirred egr

[PATCH net-next 2/2] net: sched: protect against stack overflow in TC act_mirred

2019-06-24 Thread John Hurley
TC hooks allow the application of filters and actions to packets at both ingress and egress of the network stack. It is possible, with poor configuration, that this can produce loops whereby an ingress hook calls a mirred egress action that has an egress hook that redirects back to the first ingres