| Message ID | 4BEAB54A.2070203@pandora.be |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
On Wed, 12 May 2010 16:03:54 +0200 Bart De Schuymer <bdschuym@pandora.be> wrote: > Patrick McHardy wrote: > > Eric Dumazet wrote: > >> Le mardi 11 mai 2010 à 20:25 -0700, Stephen Hemminger a écrit : > >>> This is a regression that is showing up now in net-next, not sure what > >>> changed recently in bridge netfilter that could be causing it? > >>> > >>> [ 4593.956206] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 > >>> [ 4593.956219] IP: [<ffffffffa03357a4>] br_nf_forward_finish+0x154/0x170 [bridge] > >> Not sure, but br_nf_forward_ip() has following check : > >> > >> if (!skb->nf_bridge) > >> return NF_ACCEPT; > >> > >> while br_nf_forward_arp() missed this check ... > >> > >> So we can dereference null pointer later > > > > That looks correct to me, offset 0x18 would be nf_bridge_info->mask. > > Bart, please review, thanks. > > > >> diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c > >> index 93f80fe..cd2e5f5 100644 > >> --- a/net/bridge/br_netfilter.c > >> +++ b/net/bridge/br_netfilter.c > >> @@ -723,6 +723,9 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb, > >> return NF_ACCEPT; > >> #endif > >> > >> + if (!skb->nf_bridge) > >> + return NF_ACCEPT; > >> + > >> if (skb->protocol != htons(ETH_P_ARP)) { > >> if (!IS_VLAN_ARP(skb)) > >> return NF_ACCEPT; > > That won't fix it since nf_bridge isn't used in the ARP case. The > correct fix is below. Does anyone know why the null pointer > dereference (skb->nf_bridge->mask & BRNF_8021Q) in > nf_bridge_update_protocol() didn't cause my uml kernel to crash?? > > cheers, > Bart > > > Don't call nf_bridge_update_protocol() for ARP traffic as > skb->nf_bridge isn't used in the ARP case. > > > Signed-off-by: Bart De Schuymer <bdschuym@pandora.be> > Reported-by: Stephen Hemminger <shemminger@vyatta.com> > > diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c > index 93f80fe..4442099 100644 > --- a/net/bridge/br_netfilter.c > +++ b/net/bridge/br_netfilter.c > @@ -643,10 +643,10 @@ static int br_nf_forward_finish(struct sk_buff *skb) > skb->pkt_type = PACKET_OTHERHOST; > nf_bridge->mask ^= BRNF_PKT_TYPE; > } > + nf_bridge_update_protocol(skb); > } else { > in = *((struct net_device **)(skb->cb)); > } > - nf_bridge_update_protocol(skb); > nf_bridge_push_encap_header(skb); > > NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, in, > This has worked all day for me without problem.
Stephen Hemminger wrote: > On Wed, 12 May 2010 16:03:54 +0200 >> Don't call nf_bridge_update_protocol() for ARP traffic as >> skb->nf_bridge isn't used in the ARP case. >> >> >> Signed-off-by: Bart De Schuymer <bdschuym@pandora.be> >> Reported-by: Stephen Hemminger <shemminger@vyatta.com> >> >> diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c >> index 93f80fe..4442099 100644 >> --- a/net/bridge/br_netfilter.c >> +++ b/net/bridge/br_netfilter.c >> @@ -643,10 +643,10 @@ static int br_nf_forward_finish(struct sk_buff *skb) >> skb->pkt_type = PACKET_OTHERHOST; >> nf_bridge->mask ^= BRNF_PKT_TYPE; >> } >> + nf_bridge_update_protocol(skb); >> } else { >> in = *((struct net_device **)(skb->cb)); >> } >> - nf_bridge_update_protocol(skb); >> nf_bridge_push_encap_header(skb); >> >> NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, in, >> > > This has worked all day for me without problem. Applied, thanks everyone. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c index 93f80fe..4442099 100644 --- a/net/bridge/br_netfilter.c +++ b/net/bridge/br_netfilter.c @@ -643,10 +643,10 @@ static int br_nf_forward_finish(struct sk_buff *skb) skb->pkt_type = PACKET_OTHERHOST; nf_bridge->mask ^= BRNF_PKT_TYPE; } + nf_bridge_update_protocol(skb); } else { in = *((struct net_device **)(skb->cb)); } - nf_bridge_update_protocol(skb); nf_bridge_push_encap_header(skb); NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, in,