ipip_fill_forward_path() and ip6_tnl_fill_forward_path() look up the
route to the tunnel's remote endpoint and set ctx->dev to its device,
which is the tunnel itself when that route resolves back to the tunnel.
dev_fill_forward_path() then makes no progress and trips
WARN_ON_ONCE(last_dev == ctx->dev) as soon as a flowtable tries to
offload a flow through the tunnel. That routing loop is a configuration
any CAP_NET_ADMIN user can set up, and ip_tunnel_xmit() and
ip6_tnl_xmit() already treat it as a tx error, so remove the warning and
just fail the walk, as commit 008e7a7c293b ("net: remove WARN_ON_ONCE
when accessing forward path array") did for the path stack overflow.

Fixes: ab427db17885 ("netfilter: flowtable: Add IPIP rx sw acceleration")
Fixes: d98103575dcd ("netfilter: flowtable: Add IP6IP6 rx sw acceleration")
Closes: https://lore.kernel.org/all/CA+0ovCgaRvbd0Udj70b2xxG8Cx3CaCpNhnf1V4RWQuDveZYZhA@mail.gmail.com/
Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org>
Assisted-by: Claude:claude-opus-5 syzkaller
Signed-off-by: Farhad Alemi <farhad.alemi@berkeley.edu>
---
v2:
 - Remove the WARN_ON_ONCE() in dev_fill_forward_path() instead of
   rejecting the looping route in the tunnel drivers (Pablo Neira Ayuso).
 - Add the Fixes: tags (Xuanqiang Luo).

v1: https://lore.kernel.org/all/CA+0ovCj+Pd5owGH+51rA8-RDu9YFx5oYUv8bV0zOE72QgVfY0A@mail.gmail.com/

diff --git a/net/core/dev.c b/net/core/dev.c
index ecfbd72d5d1a..c67900354fa6 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -789,7 +789,7 @@ int dev_fill_forward_path(struct net_device_path_ctx
 			goto err_out;

 		stack->num_paths++;
-		if (WARN_ON_ONCE(last_dev == ctx->dev))
+		if (last_dev == ctx->dev)
 			goto err_out;
 	}

-- 
2.53.0

On Sat, 12 Sep 2026 07:40:09 +0000 Farhad Alemi wrote:
> ipip_fill_forward_path() and ip6_tnl_fill_forward_path() look up the
> route to the tunnel's remote endpoint and set ctx->dev to its device,
> which is the tunnel itself when that route resolves back to the tunnel.
> dev_fill_forward_path() then makes no progress and trips
> WARN_ON_ONCE(last_dev == ctx->dev) as soon as a flowtable tries to
> offload a flow through the tunnel. That routing loop is a configuration
> any CAP_NET_ADMIN user can set up, and ip_tunnel_xmit() and
> ip6_tnl_xmit() already treat it as a tx error, so remove the warning and
> just fail the walk, as commit 008e7a7c293b ("net: remove WARN_ON_ONCE
> when accessing forward path array") did for the path stack overflow.
> 
> Fixes: ab427db17885 ("netfilter: flowtable: Add IPIP rx sw acceleration")
> Fixes: d98103575dcd ("netfilter: flowtable: Add IP6IP6 rx sw acceleration")
> Closes: https://lore.kernel.org/all/CA+0ovCgaRvbd0Udj70b2xxG8Cx3CaCpNhnf1V4RWQuDveZYZhA@mail.gmail.com/
> Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org>
> Assisted-by: Claude:claude-opus-5 syzkaller
> Signed-off-by: Farhad Alemi <farhad.alemi@berkeley.edu>

Applied as 150dba2c69e933 in net, thanks
-- 
pw-bot: accept

在 2026/9/12 15:40, Farhad Alemi 写道:
> ipip_fill_forward_path() and ip6_tnl_fill_forward_path() look up the
> route to the tunnel's remote endpoint and set ctx->dev to its device,
> which is the tunnel itself when that route resolves back to the tunnel.
> dev_fill_forward_path() then makes no progress and trips
> WARN_ON_ONCE(last_dev == ctx->dev) as soon as a flowtable tries to
> offload a flow through the tunnel. That routing loop is a configuration
> any CAP_NET_ADMIN user can set up, and ip_tunnel_xmit() and
> ip6_tnl_xmit() already treat it as a tx error, so remove the warning and
> just fail the walk, as commit 008e7a7c293b ("net: remove WARN_ON_ONCE
> when accessing forward path array") did for the path stack overflow.
> 
> Fixes: ab427db17885 ("netfilter: flowtable: Add IPIP rx sw acceleration")
> Fixes: d98103575dcd ("netfilter: flowtable: Add IP6IP6 rx sw acceleration")
> Closes: https://lore.kernel.org/all/CA+0ovCgaRvbd0Udj70b2xxG8Cx3CaCpNhnf1V4RWQuDveZYZhA@mail.gmail.com/
> Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org>
> Assisted-by: Claude:claude-opus-5 syzkaller
> Signed-off-by: Farhad Alemi <farhad.alemi@berkeley.edu>

Reviewed-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

Thanks,
Xuanqiang

> ---
> v2:
>   - Remove the WARN_ON_ONCE() in dev_fill_forward_path() instead of
>     rejecting the looping route in the tunnel drivers (Pablo Neira Ayuso).
>   - Add the Fixes: tags (Xuanqiang Luo).
> 
> v1: https://lore.kernel.org/all/CA+0ovCj+Pd5owGH+51rA8-RDu9YFx5oYUv8bV0zOE72QgVfY0A@mail.gmail.com/
> 
> diff --git a/net/core/dev.c b/net/core/dev.c
> index ecfbd72d5d1a..c67900354fa6 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -789,7 +789,7 @@ int dev_fill_forward_path(struct net_device_path_ctx
>   			goto err_out;
> 
>   		stack->num_paths++;
> -		if (WARN_ON_ONCE(last_dev == ctx->dev))
> +		if (last_dev == ctx->dev)
>   			goto err_out;
>   	}
>