diff options
author | Pavel Tikhomirov <ptikhomirov@virtuozzo.com> | 2024-01-11 18:06:40 +0300 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2024-01-17 14:02:49 +0300 |
commit | 9874808878d9eed407e3977fd11fee49de1e1d86 (patch) | |
tree | 93e45fd71e19c245e3562cdda28b9d94982cc38a /net/ipv6/netfilter/ip6table_raw.c | |
parent | a54e72197037d2c9bfcd70dddaac8c8ccb5b41ba (diff) | |
download | linux-9874808878d9eed407e3977fd11fee49de1e1d86.tar.xz |
netfilter: bridge: replace physindev with physinif in nf_bridge_info
An skb can be added to a neigh->arp_queue while waiting for an arp
reply. Where original skb's skb->dev can be different to neigh's
neigh->dev. For instance in case of bridging dnated skb from one veth to
another, the skb would be added to a neigh->arp_queue of the bridge.
As skb->dev can be reset back to nf_bridge->physindev and used, and as
there is no explicit mechanism that prevents this physindev from been
freed under us (for instance neigh_flush_dev doesn't cleanup skbs from
different device's neigh queue) we can crash on e.g. this stack:
arp_process
neigh_update
skb = __skb_dequeue(&neigh->arp_queue)
neigh_resolve_output(..., skb)
...
br_nf_dev_xmit
br_nf_pre_routing_finish_bridge_slow
skb->dev = nf_bridge->physindev
br_handle_frame_finish
Let's use plain ifindex instead of net_device link. To peek into the
original net_device we will use dev_get_by_index_rcu(). Thus either we
get device and are safe to use it or we don't get it and drop skb.
Fixes: c4e70a87d975 ("netfilter: bridge: rename br_netfilter.c to br_netfilter_hooks.c")
Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/ipv6/netfilter/ip6table_raw.c')
0 files changed, 0 insertions, 0 deletions