| Message ID | 20200224164622.1472051-1-nikolay@cumulusnetworks.com |
|---|---|
| State | Accepted |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net,v2] net: bridge: fix stale eth hdr pointer in br_dev_xmit | expand |
On Mon, 24 Feb 2020 18:46:22 +0200 Nikolay Aleksandrov <nikolay@cumulusnetworks.com> wrote: > - eth = eth_hdr(skb); > skb_pull(skb, ETH_HLEN) you could just swap these two lines.
On 24 February 2020 18:54:27 EET, Stephen Hemminger <stephen@networkplumber.org> wrote: >On Mon, 24 Feb 2020 18:46:22 +0200 >Nikolay Aleksandrov <nikolay@cumulusnetworks.com> wrote: > >> - eth = eth_hdr(skb); >> skb_pull(skb, ETH_HLEN) > >you could just swap these two lines. Can't, still caching the wrong mac_header offset. br_allowed_ingress() can change the head pointer and also the offsets inside.
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> Date: Mon, 24 Feb 2020 18:46:22 +0200 > In br_dev_xmit() we perform vlan filtering in br_allowed_ingress() but > if the packet has the vlan header inside (e.g. bridge with disabled > tx-vlan-offload) then the vlan filtering code will use skb_vlan_untag() > to extract the vid before filtering which in turn calls pskb_may_pull() > and we may end up with a stale eth pointer. Moreover the cached eth header > pointer will generally be wrong after that operation. Remove the eth header > caching and just use eth_hdr() directly, the compiler does the right thing > and calculates it only once so we don't lose anything. > > Fixes: 057658cb33fb ("bridge: suppress arp pkts on BR_NEIGH_SUPPRESS ports") > Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> > --- > v2: remove syzbot's reported-by tag, this seems to be a different bug Applied and queued up for -stable, thanks Nikolay.
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c index dc3d2c1dd9d5..0e3dbc5f3c34 100644 --- a/net/bridge/br_device.c +++ b/net/bridge/br_device.c @@ -34,7 +34,6 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev) const struct nf_br_ops *nf_ops; u8 state = BR_STATE_FORWARDING; const unsigned char *dest; - struct ethhdr *eth; u16 vid = 0; rcu_read_lock(); @@ -54,15 +53,14 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev) BR_INPUT_SKB_CB(skb)->frag_max_size = 0; skb_reset_mac_header(skb); - eth = eth_hdr(skb); skb_pull(skb, ETH_HLEN); if (!br_allowed_ingress(br, br_vlan_group_rcu(br), skb, &vid, &state)) goto out; if (IS_ENABLED(CONFIG_INET) && - (eth->h_proto == htons(ETH_P_ARP) || - eth->h_proto == htons(ETH_P_RARP)) && + (eth_hdr(skb)->h_proto == htons(ETH_P_ARP) || + eth_hdr(skb)->h_proto == htons(ETH_P_RARP)) && br_opt_get(br, BROPT_NEIGH_SUPPRESS_ENABLED)) { br_do_proxy_suppress_arp(skb, br, vid, NULL); } else if (IS_ENABLED(CONFIG_IPV6) &&
In br_dev_xmit() we perform vlan filtering in br_allowed_ingress() but if the packet has the vlan header inside (e.g. bridge with disabled tx-vlan-offload) then the vlan filtering code will use skb_vlan_untag() to extract the vid before filtering which in turn calls pskb_may_pull() and we may end up with a stale eth pointer. Moreover the cached eth header pointer will generally be wrong after that operation. Remove the eth header caching and just use eth_hdr() directly, the compiler does the right thing and calculates it only once so we don't lose anything. Fixes: 057658cb33fb ("bridge: suppress arp pkts on BR_NEIGH_SUPPRESS ports") Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> --- v2: remove syzbot's reported-by tag, this seems to be a different bug net/bridge/br_device.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)