Re: [Bridge] [PATCH net v2] net: bridge: fix stale eth hdr pointer in br_dev_xmit

[David Miller]

From: Nikolay Aleksandrov 
Date: Mon, 24 Feb 2020 18:46:22 +0200

> In br_dev_xmit() we perform vlan filtering in br_allowed_ingress() but
> if the packet has the vlan header inside (e.g. bridge with disabled
> tx-vlan-offload) then the vlan filtering code will use skb_vlan_untag()
> to extract the vid before filtering which in turn calls pskb_may_pull()
> and we may end up with a stale eth pointer. Moreover the cached eth header
> pointer will generally be wrong after that operation. Remove the eth header
> caching and just use eth_hdr() directly, the compiler does the right thing
> and calculates it only once so we don't lose anything.
> 
> Fixes: 057658cb33fb ("bridge: suppress arp pkts on BR_NEIGH_SUPPRESS ports")
> Signed-off-by: Nikolay Aleksandrov 
> ---
> v2: remove syzbot's reported-by tag, this seems to be a different bug

Applied and queued up for -stable, thanks Nikolay.

Re: [Bridge] [PATCH net v2] net: bridge: fix stale eth hdr pointer in br_dev_xmit

[Stephen Hemminger]

On Mon, 24 Feb 2020 18:46:22 +0200
Nikolay Aleksandrov  wrote:

> - eth = eth_hdr(skb);
>   skb_pull(skb, ETH_HLEN)

you could just swap these two lines.

Re: [Bridge] [PATCH net v2] net: bridge: fix stale eth hdr pointer in br_dev_xmit

[nikolay]

On 24 February 2020 18:54:27 EET, Stephen Hemminger 
 wrote:
>On Mon, 24 Feb 2020 18:46:22 +0200
>Nikolay Aleksandrov  wrote:
>
>> -eth = eth_hdr(skb);
>>  skb_pull(skb, ETH_HLEN)
>
>you could just swap these two lines.

Can't, still caching the wrong mac_header offset. br_allowed_ingress() can 
change the head pointer and also the offsets inside. 

[Bridge] [PATCH net v2] net: bridge: fix stale eth hdr pointer in br_dev_xmit

[Nikolay Aleksandrov]

In br_dev_xmit() we perform vlan filtering in br_allowed_ingress() but
if the packet has the vlan header inside (e.g. bridge with disabled
tx-vlan-offload) then the vlan filtering code will use skb_vlan_untag()
to extract the vid before filtering which in turn calls pskb_may_pull()
and we may end up with a stale eth pointer. Moreover the cached eth header
pointer will generally be wrong after that operation. Remove the eth header
caching and just use eth_hdr() directly, the compiler does the right thing
and calculates it only once so we don't lose anything.

Fixes: 057658cb33fb ("bridge: suppress arp pkts on BR_NEIGH_SUPPRESS ports")
Signed-off-by: Nikolay Aleksandrov 
---
v2: remove syzbot's reported-by tag, this seems to be a different bug

 net/bridge/br_device.c | 6 ++
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index dc3d2c1dd9d5..0e3dbc5f3c34 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -34,7 +34,6 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct 
net_device *dev)
const struct nf_br_ops *nf_ops;
u8 state = BR_STATE_FORWARDING;
const unsigned char *dest;
-   struct ethhdr *eth;
u16 vid = 0;
 
rcu_read_lock();
@@ -54,15 +53,14 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct 
net_device *dev)
BR_INPUT_SKB_CB(skb)->frag_max_size = 0;
 
skb_reset_mac_header(skb);
-   eth = eth_hdr(skb);
skb_pull(skb, ETH_HLEN);
 
if (!br_allowed_ingress(br, br_vlan_group_rcu(br), skb, , ))
goto out;
 
if (IS_ENABLED(CONFIG_INET) &&
-   (eth->h_proto == htons(ETH_P_ARP) ||
-eth->h_proto == htons(ETH_P_RARP)) &&
+   (eth_hdr(skb)->h_proto == htons(ETH_P_ARP) ||
+eth_hdr(skb)->h_proto == htons(ETH_P_RARP)) &&
br_opt_get(br, BROPT_NEIGH_SUPPRESS_ENABLED)) {
br_do_proxy_suppress_arp(skb, br, vid, NULL);
} else if (IS_ENABLED(CONFIG_IPV6) &&
-- 
2.24.1