From patchwork Thu Apr 11 10:56:39 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Aleksandrov X-Patchwork-Id: 1083914 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=cumulusnetworks.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=cumulusnetworks.com header.i=@cumulusnetworks.com header.b="ggtbRiZ7"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 44fyfg34Tcz9s47 for ; Thu, 11 Apr 2019 20:57:47 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726676AbfDKK5p (ORCPT ); Thu, 11 Apr 2019 06:57:45 -0400 Received: from mail-wr1-f67.google.com ([209.85.221.67]:38385 "EHLO mail-wr1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726121AbfDKK5p (ORCPT ); Thu, 11 Apr 2019 06:57:45 -0400 Received: by mail-wr1-f67.google.com with SMTP id k11so6735327wro.5 for ; Thu, 11 Apr 2019 03:57:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cumulusnetworks.com; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=e2Cyu5wZD1o5O7FXPAqIqm0AabQ+tygwXhac+ZfAR/w=; b=ggtbRiZ7+Tfdi/t5Z5Nj5eb4KwbnbsbfrwCAeZYgMWI/ARM49nLAcigtkIyyRsP1nL T/SKjAYmDTQLHuj3cOPXta+kjiNqbEuQ7ibY9IhGhWRE0unNjjyAigFzDiV78Gc875S9 e2YfQxqX3txcGYor6qlF2HBfFkyhSrf0A0NRU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=e2Cyu5wZD1o5O7FXPAqIqm0AabQ+tygwXhac+ZfAR/w=; b=ZagCKm4N4Q4JumUgYfOoth5Y1NXIB1KmzTIYAs4htF3hxo9HYZfRPq4LS1VbjFdUWc aKOyOHCjB8yRxETZepONYtR7o/77t7w+IxRdKfvT2X9Bgr8Z0shtJt2vs+1SYz1bahYT OA71veyW+2HKAGiFzp+KCo3EC/1UlEOMu38JpEeVhVjSpYPmipjXqmhgdNY0WxDRw1Vj bkWm5td7zEbmkByf6CeykKFI11sWQcL0nUIhOsvjQLK7fXNmDRoKC5HLQcWNwG/AbiM9 Cn6b34AdKsGGXapyF1wN01ltYBtP7qskjGsk3TOC4VQMwmubwRt8aH9BqZ9IkoN3O2gG 1eJw== X-Gm-Message-State: APjAAAWzI4h6FJEZaPvtTwRgaJcnkfNPpZP9LQiDM6aS/YRq2hscNuHq SU8ei/5HQmbKfixiP/JrSg1FMzNIl6k+FQ== X-Google-Smtp-Source: APXvYqzw9pHbHoP2JSEtRyTqPhTlsVKYoKVPfc5d3URKyX1gNRJFVCHUTu1Md/TKqdAhp95SbtrcAw== X-Received: by 2002:adf:afe1:: with SMTP id y33mr32128076wrd.288.1554980263739; Thu, 11 Apr 2019 03:57:43 -0700 (PDT) Received: from localhost.localdomain (84-238-136-197.ip.btc-net.bg. [84.238.136.197]) by smtp.gmail.com with ESMTPSA id x21sm31991016wrd.45.2019.04.11.03.57.42 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Thu, 11 Apr 2019 03:57:42 -0700 (PDT) From: Nikolay Aleksandrov To: netdev@vger.kernel.org Cc: fw@strlen.de, roopa@cumulusnetworks.com, bridge@lists.linux-foundation.org, Nikolay Aleksandrov Subject: [PATCH net] net: bridge: fix per-port af_packet sockets Date: Thu, 11 Apr 2019 13:56:39 +0300 Message-Id: <20190411105639.7358-1-nikolay@cumulusnetworks.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org When the commit below was introduced it changed two visible things: - the skb was no longer passed through the protocol handlers with the original device - the skb was passed up the stack with skb->dev = bridge The first change broke af_packet sockets on bridge ports. For example we use them for hostapd which listens for ETH_P_PAE packets on the ports. We discussed two possible fixes: - create a clone and pass it through NF_HOOK(), act on the original skb based on the result - somehow signal to the caller from the okfn() that it was called, meaning the skb is ok to be passed, which this patch is trying to implement via returning 1 from the bridge link-local okfn() Note that we rely on the fact that NF_QUEUE/STOLEN would return 0 and drop/error would return < 0 thus the okfn() is called only when the return was 1, so we signal to the caller that it was called by preserving the return value from nf_hook(). Fixes: 8626c56c8279 ("bridge: fix potential use-after-free when hook returns QUEUE or STOLEN verdict") Signed-off-by: Nikolay Aleksandrov --- I plan to make a selftest for this one too. Once we agree on the fix. net/bridge/br_input.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c index 5ea7e56119c1..ba303ee99b9b 100644 --- a/net/bridge/br_input.c +++ b/net/bridge/br_input.c @@ -197,13 +197,10 @@ static void __br_handle_local_finish(struct sk_buff *skb) /* note: already called with rcu_read_lock */ static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb) { - struct net_bridge_port *p = br_port_get_rcu(skb->dev); - __br_handle_local_finish(skb); - BR_INPUT_SKB_CB(skb)->brdev = p->br->dev; - br_pass_frame_up(skb); - return 0; + /* return 1 to signal the okfn() was called so it's ok to use the skb */ + return 1; } /* @@ -280,10 +277,18 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb) goto forward; } - /* Deliver packet to local host only */ - NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, dev_net(skb->dev), - NULL, skb, skb->dev, NULL, br_handle_local_finish); - return RX_HANDLER_CONSUMED; + /* The else clause should be hit when nf_hook(): + * - returns < 0 (drop/error) + * - returns = 0 (stolen/nf_queue) + * Thus return 1 from the okfn() to signal the skb is ok to pass + */ + if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, + dev_net(skb->dev), NULL, skb, skb->dev, NULL, + br_handle_local_finish) == 1) { + return RX_HANDLER_PASS; + } else { + return RX_HANDLER_CONSUMED; + } } forward: