Pablo Neira Ayuso b13db0d16b netfilter: br_netfilter: skip conntrack input hook for promisc packets ... [ Upstream commit 751de2012e ] For historical reasons, when bridge device is in promisc mode, packets that are directed to the taps follow bridge input hook path. This patch adds a workaround to reset conntrack for these packets. Jianbo Liu reports warning splats in their test infrastructure where cloned packets reach the br_netfilter input hook to confirm the conntrack object. Scratch one bit from BR_INPUT_SKB_CB to annotate that this packet has reached the input hook because it is passed up to the bridge device to reach the taps. [ 57.571874] WARNING: CPU: 1 PID: 0 at net/bridge/br_netfilter_hooks.c:616 br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.572749] Modules linked in: xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_isc si ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5ctl mlx5_core [ 57.575158] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0+ #19 [ 57.575700] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 57.576662] RIP: 0010:br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.577195] Code: fe ff ff 41 bd 04 00 00 00 be 04 00 00 00 e9 4a ff ff ff be 04 00 00 00 48 89 ef e8 f3 a9 3c e1 66 83 ad b4 00 00 00 04 eb 91 <0f> 0b e9 f1 fe ff ff 0f 0b e9 df fe ff ff 48 89 df e8 b3 53 47 e1 [ 57.578722] RSP: 0018:ffff88885f845a08 EFLAGS: 00010202 [ 57.579207] RAX: 0000000000000002 RBX: ffff88812dfe8000 RCX: 0000000000000000 [ 57.579830] RDX: ffff88885f845a60 RSI: ffff8881022dc300 RDI: 0000000000000000 [ 57.580454] RBP: ffff88885f845a60 R08: 0000000000000001 R09: 0000000000000003 [ 57.581076] R10: 00000000ffff1300 R11: 0000000000000002 R12: 0000000000000000 [ 57.581695] R13: ffff8881047ffe00 R14: ffff888108dbee00 R15: ffff88814519b800 [ 57.582313] FS: 0000000000000000(0000) GS:ffff88885f840000(0000) knlGS:0000000000000000 [ 57.583040] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 57.583564] CR2: 000000c4206aa000 CR3: 0000000103847001 CR4: 0000000000370eb0 [ 57.584194] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 57.584820] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 57.585440] Call Trace: [ 57.585721] <IRQ> [ 57.585976] ? __warn+0x7d/0x130 [ 57.586323] ? br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.586811] ? report_bug+0xf1/0x1c0 [ 57.587177] ? handle_bug+0x3f/0x70 [ 57.587539] ? exc_invalid_op+0x13/0x60 [ 57.587929] ? asm_exc_invalid_op+0x16/0x20 [ 57.588336] ? br_nf_local_in+0x157/0x180 [br_netfilter] [ 57.588825] nf_hook_slow+0x3d/0xd0 [ 57.589188] ? br_handle_vlan+0x4b/0x110 [ 57.589579] br_pass_frame_up+0xfc/0x150 [ 57.589970] ? br_port_flags_change+0x40/0x40 [ 57.590396] br_handle_frame_finish+0x346/0x5e0 [ 57.590837] ? ipt_do_table+0x32e/0x430 [ 57.591221] ? br_handle_local_finish+0x20/0x20 [ 57.591656] br_nf_hook_thresh+0x4b/0xf0 [br_netfilter] [ 57.592286] ? br_handle_local_finish+0x20/0x20 [ 57.592802] br_nf_pre_routing_finish+0x178/0x480 [br_netfilter] [ 57.593348] ? br_handle_local_finish+0x20/0x20 [ 57.593782] ? nf_nat_ipv4_pre_routing+0x25/0x60 [nf_nat] [ 57.594279] br_nf_pre_routing+0x24c/0x550 [br_netfilter] [ 57.594780] ? br_nf_hook_thresh+0xf0/0xf0 [br_netfilter] [ 57.595280] br_handle_frame+0x1f3/0x3d0 [ 57.595676] ? br_handle_local_finish+0x20/0x20 [ 57.596118] ? br_handle_frame_finish+0x5e0/0x5e0 [ 57.596566] __netif_receive_skb_core+0x25b/0xfc0 [ 57.597017] ? __napi_build_skb+0x37/0x40 [ 57.597418] __netif_receive_skb_list_core+0xfb/0x220 Fixes: 62e7151ae3 ("netfilter: bridge: confirm multicast packets before passing them up the stack") Reported-by: Jianbo Liu <jianbol@nvidia.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-04-27 17:07:07 +02:00
..
netfilter	netfilter: br_netfilter: skip conntrack input hook for promisc packets	2024-04-27 17:07:07 +02:00
br.c	net: bridge: mst: Multiple Spanning Tree (MST) mode	2022-03-17 16:49:57 -07:00
br_arp_nd_proxy.c	neighbour: annotate lockless accesses to n->nud_state	2023-10-10 22:00:42 +02:00
br_cfm.c	bridge: cfm: remove redundant return	2021-06-22 10:35:15 -07:00
br_cfm_netlink.c	bridge: cfm: fix enum typo in br_cc_ccm_tx_parse	2024-02-05 20:12:54 +00:00
br_device.c	bridge: move from strlcpy with unused retval to strscpy	2022-08-22 17:57:30 -07:00
br_fdb.c	rtnetlink: add extack support in fdb del handlers	2022-05-09 11:58:20 +01:00
br_forward.c	net: bridge: use DEV_STATS_INC()	2023-10-06 14:56:41 +02:00
br_if.c	net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode	2023-07-19 16:22:04 +02:00
br_input.c	netfilter: br_netfilter: skip conntrack input hook for promisc packets	2024-04-27 17:07:07 +02:00
br_ioctl.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2021-12-31 14:35:40 +00:00
br_mdb.c	net: bridge: allow add/remove permanent mdb entries on disabled ports	2022-06-15 09:35:21 +01:00
br_mrp.c	net: bridge: mrp: Update the Test frames for MRA	2021-06-28 15:46:10 -07:00
br_mrp_netlink.c	bridge: mrp: Use hlist_head instead of list_head for mrp	2020-11-09 16:42:12 -08:00
br_mrp_switchdev.c	bridge: mrp: Extend br_mrp_switchdev to detect better the errors	2021-02-16 14:47:46 -08:00
br_mst.c	net: bridge: mst: Add helper to query a port's MST state	2022-03-17 16:49:58 -07:00
br_multicast.c	bridge: mcast: fix disabled snooping after long uptime	2024-02-05 20:13:01 +00:00
br_multicast_eht.c	net: bridge: multicast: use multicast contexts instead of bridge or port	2021-07-20 05:41:19 -07:00
br_netfilter_hooks.c	netfilter: br_netfilter: skip conntrack input hook for promisc packets	2024-04-27 17:07:07 +02:00
br_netfilter_ipv6.c	netfilter: bridge: replace physindev with physinif in nf_bridge_info	2024-01-25 15:27:51 -08:00
br_netlink.c	bridge: Fix flushing of dynamic FDB entries	2022-11-02 20:47:09 -07:00
br_netlink_tunnel.c
br_nf_core.c
br_private.h	netfilter: br_netfilter: skip conntrack input hook for promisc packets	2024-04-27 17:07:07 +02:00
br_private_cfm.h	bridge: cfm: Kernel space implementation of CFM. CCM frame RX added.	2020-10-29 18:39:43 -07:00
br_private_mcast_eht.h	net: bridge: multicast: use multicast contexts instead of bridge or port	2021-07-20 05:41:19 -07:00
br_private_mrp.h	net: bridge: mrp: Update the Test frames for MRA	2021-06-28 15:46:10 -07:00
br_private_stp.h
br_private_tunnel.h	bridge: always declare tunnel functions	2023-05-24 17:32:48 +01:00
br_stp.c	net: bridge: mst: Multiple Spanning Tree (MST) mode	2022-03-17 16:49:57 -07:00
br_stp_bpdu.c
br_stp_if.c	Revert "bridge: Add extack warning when enabling STP in netns."	2023-09-13 09:42:20 +02:00
br_stp_timer.c
br_switchdev.c	net: bridge: switchdev: Ensure deferred event delivery on unoffload	2024-03-01 13:26:36 +01:00
br_sysfs_br.c	bridge: Fix flushing of dynamic FDB entries	2022-11-02 20:47:09 -07:00
br_sysfs_if.c	bridge: move from strlcpy with unused retval to strscpy	2022-08-22 17:57:30 -07:00
br_vlan.c	bridge: switchdev: Fix memory leaks when changing VLAN protocol	2022-11-15 13:38:11 +01:00
br_vlan_options.c	net: bridge: mst: Allow changing a VLAN's MSTI	2022-03-17 16:49:57 -07:00
br_vlan_tunnel.c	net: bridge: change return type of br_handle_ingress_vlan_tunnel	2021-08-24 16:51:09 -07:00
Kconfig	bridge: cfm: Add BRIDGE_CFM to Kconfig.	2020-10-29 18:39:43 -07:00
Makefile	net: bridge: mst: Multiple Spanning Tree (MST) mode	2022-03-17 16:49:57 -07:00