net: ipv6: ioam6: fix lwtunnel_output() loop

Fix the lwtunnel_output() reentry loop in ioam6_iptunnel when the
destination is the same after transformation. Note that a check on the
destination address was already performed, but it was not enough. This
is the example of a lwtunnel user taking care of loops without relying
only on the last resort detection offered by lwtunnel.

Fixes: 8cb3bf8bff3c ("ipv6: ioam: Add support for the ip6ip6 encapsulation")
Signed-off-by: Justin Iurman <justin.iurman@uliege.be>
Link: https://patch.msgid.link/20250314120048.12569-3-justin.iurman@uliege.be
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/net/ipv6/ioam6_iptunnel.c b/net/ipv6/ioam6_iptunnel.c
index 2c383c12a431599fe9740a71d564376c94148b57..09065187378e6e330ba232c4dc1d59680541f976 100644 (file)
--- a/net/ipv6/ioam6_iptunnel.c
+++ b/net/ipv6/ioam6_iptunnel.c
@@ -337,7 +337,6 @@ static int ioam6_do_encap(struct net *net, struct sk_buff *skb,
 static int ioam6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
        struct dst_entry *dst = skb_dst(skb), *cache_dst = NULL;
-       struct in6_addr orig_daddr;
        struct ioam6_lwt *ilwt;
        int err = -EINVAL;
        u32 pkt_cnt;
@@ -352,8 +351,6 @@ static int ioam6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
        if (pkt_cnt % ilwt->freq.n >= ilwt->freq.k)
                goto out;
 
-       orig_daddr = ipv6_hdr(skb)->daddr;
-
        local_bh_disable();
        cache_dst = dst_cache_get(&ilwt->cache);
        local_bh_enable();
@@ -422,7 +419,10 @@ do_encap:
                        goto drop;
        }
 
-       if (!ipv6_addr_equal(&orig_daddr, &ipv6_hdr(skb)->daddr)) {
+       /* avoid lwtunnel_output() reentry loop when destination is the same
+        * after transformation (e.g., with the inline mode)
+        */
+       if (dst->lwtstate != cache_dst->lwtstate) {
                skb_dst_drop(skb);
                skb_dst_set(skb, cache_dst);
                return dst_output(net, sk, skb);