Re: [PATCH net] net/core: add xmit recursion limit to qdisc transmit path

[Eric Dumazet]

On Tue, Mar 3, 2026 at 3:37 AM <bestswngs@xxxxxxxxx> wrote:
>
> From: Weiming Shi <bestswngs@xxxxxxxxx>
>
> __dev_queue_xmit() has two transmit code paths depending on whether the
> device has a qdisc attached:
>
>   1. Qdisc path (q->enqueue): calls __dev_xmit_skb()
>   2. No-qdisc path: calls dev_hard_start_xmit() directly
>
> Commit 745e20f1b626 ("net: add a recursion limit in xmit path") added
> recursion protection to the no-qdisc path via dev_xmit_recursion()
> check and dev_xmit_recursion_inc()/dec() tracking. However, the qdisc
> path performs no recursion depth checking at all.
>
> This allows unbounded recursion through qdisc-attached devices. For
> example, a bond interface in broadcast mode with gretap slaves whose
> remote endpoints route back through the bond creates an infinite
> transmit loop that exhausts the kernel stack:

Non lltx drivers would deadlock in HARD_TX_LOCK().

I would prefer we try to fix this issue at configuration time instead
of adding yet another expensive operations in the fast path.

Can you provide a test ?

Thanks.