mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-27 12:57:53 +00:00
9874808878
An skb can be added to a neigh->arp_queue while waiting for an arp
reply. Where original skb's skb->dev can be different to neigh's
neigh->dev. For instance in case of bridging dnated skb from one veth to
another, the skb would be added to a neigh->arp_queue of the bridge.
As skb->dev can be reset back to nf_bridge->physindev and used, and as
there is no explicit mechanism that prevents this physindev from been
freed under us (for instance neigh_flush_dev doesn't cleanup skbs from
different device's neigh queue) we can crash on e.g. this stack:
arp_process
neigh_update
skb = __skb_dequeue(&neigh->arp_queue)
neigh_resolve_output(..., skb)
...
br_nf_dev_xmit
br_nf_pre_routing_finish_bridge_slow
skb->dev = nf_bridge->physindev
br_handle_frame_finish
Let's use plain ifindex instead of net_device link. To peek into the
original net_device we will use dev_get_by_index_rcu(). Thus either we
get device and are safe to use it or we don't get it and drop skb.
Fixes: c4e70a87d9 ("netfilter: bridge: rename br_netfilter.c to br_netfilter_hooks.c")
Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
88 lines
2.1 KiB
C
88 lines
2.1 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef __LINUX_BRIDGE_NETFILTER_H
|
|
#define __LINUX_BRIDGE_NETFILTER_H
|
|
|
|
#include <uapi/linux/netfilter_bridge.h>
|
|
#include <linux/skbuff.h>
|
|
|
|
struct nf_bridge_frag_data {
|
|
char mac[ETH_HLEN];
|
|
bool vlan_present;
|
|
u16 vlan_tci;
|
|
__be16 vlan_proto;
|
|
};
|
|
|
|
#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
|
|
|
|
int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb);
|
|
|
|
static inline void br_drop_fake_rtable(struct sk_buff *skb)
|
|
{
|
|
struct dst_entry *dst = skb_dst(skb);
|
|
|
|
if (dst && (dst->flags & DST_FAKE_RTABLE))
|
|
skb_dst_drop(skb);
|
|
}
|
|
|
|
static inline struct nf_bridge_info *
|
|
nf_bridge_info_get(const struct sk_buff *skb)
|
|
{
|
|
return skb_ext_find(skb, SKB_EXT_BRIDGE_NF);
|
|
}
|
|
|
|
static inline bool nf_bridge_info_exists(const struct sk_buff *skb)
|
|
{
|
|
return skb_ext_exist(skb, SKB_EXT_BRIDGE_NF);
|
|
}
|
|
|
|
static inline int nf_bridge_get_physinif(const struct sk_buff *skb)
|
|
{
|
|
const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
|
|
|
|
if (!nf_bridge)
|
|
return 0;
|
|
|
|
return nf_bridge->physinif;
|
|
}
|
|
|
|
static inline int nf_bridge_get_physoutif(const struct sk_buff *skb)
|
|
{
|
|
const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
|
|
|
|
if (!nf_bridge)
|
|
return 0;
|
|
|
|
return nf_bridge->physoutdev ? nf_bridge->physoutdev->ifindex : 0;
|
|
}
|
|
|
|
static inline struct net_device *
|
|
nf_bridge_get_physindev(const struct sk_buff *skb, struct net *net)
|
|
{
|
|
const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
|
|
|
|
return nf_bridge ? dev_get_by_index_rcu(net, nf_bridge->physinif) : NULL;
|
|
}
|
|
|
|
static inline struct net_device *
|
|
nf_bridge_get_physoutdev(const struct sk_buff *skb)
|
|
{
|
|
const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
|
|
|
|
return nf_bridge ? nf_bridge->physoutdev : NULL;
|
|
}
|
|
|
|
static inline bool nf_bridge_in_prerouting(const struct sk_buff *skb)
|
|
{
|
|
const struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb);
|
|
|
|
return nf_bridge && nf_bridge->in_prerouting;
|
|
}
|
|
#else
|
|
#define br_drop_fake_rtable(skb) do { } while (0)
|
|
static inline bool nf_bridge_in_prerouting(const struct sk_buff *skb)
|
|
{
|
|
return false;
|
|
}
|
|
#endif /* CONFIG_BRIDGE_NETFILTER */
|
|
|
|
#endif
|