Patchwork [BUG] crashes with kvm/nat networking and net-next

login
register
mail settings
Submitter Bart De Schuymer
Date May 12, 2010, 2:03 p.m.
Message ID <4BEAB54A.2070203@pandora.be>
Download mbox | patch
Permalink /patch/52385/
State Accepted
Delegated to: David Miller
Headers show

Comments

Bart De Schuymer - May 12, 2010, 2:03 p.m.
Patrick McHardy wrote:
> Eric Dumazet wrote:
>> Le mardi 11 mai 2010 à 20:25 -0700, Stephen Hemminger a écrit :
>>> This is a regression that is showing up now in net-next, not sure what
>>> changed recently in bridge netfilter that could be causing it?
>>>
>>> [ 4593.956206] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
>>> [ 4593.956219] IP: [<ffffffffa03357a4>] br_nf_forward_finish+0x154/0x170 [bridge]
>> Not sure, but br_nf_forward_ip() has following check :
>>
>> if (!skb->nf_bridge)
>> 	return NF_ACCEPT;
>>
>> while br_nf_forward_arp() missed this check ...
>>
>> So we can dereference null pointer later
> 
> That looks correct to me, offset 0x18 would be nf_bridge_info->mask.
> Bart, please review, thanks.
> 
>> diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
>> index 93f80fe..cd2e5f5 100644
>> --- a/net/bridge/br_netfilter.c
>> +++ b/net/bridge/br_netfilter.c
>> @@ -723,6 +723,9 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
>>  		return NF_ACCEPT;
>>  #endif
>>  
>> +	if (!skb->nf_bridge)
>> +		return NF_ACCEPT;
>> +
>>  	if (skb->protocol != htons(ETH_P_ARP)) {
>>  		if (!IS_VLAN_ARP(skb))
>>  			return NF_ACCEPT;

That won't fix it since nf_bridge isn't used in the ARP case. The
correct fix is below. Does anyone know why the null pointer
dereference (skb->nf_bridge->mask & BRNF_8021Q) in
nf_bridge_update_protocol() didn't cause my uml kernel to crash??

cheers,
Bart


Don't call nf_bridge_update_protocol() for ARP traffic as
skb->nf_bridge isn't used in the ARP case.


Signed-off-by: Bart De Schuymer <bdschuym@pandora.be>
Reported-by: Stephen Hemminger <shemminger@vyatta.com>
stephen hemminger - May 12, 2010, 10:15 p.m.
On Wed, 12 May 2010 16:03:54 +0200
Bart De Schuymer <bdschuym@pandora.be> wrote:

> Patrick McHardy wrote:
> > Eric Dumazet wrote:
> >> Le mardi 11 mai 2010 à 20:25 -0700, Stephen Hemminger a écrit :
> >>> This is a regression that is showing up now in net-next, not sure what
> >>> changed recently in bridge netfilter that could be causing it?
> >>>
> >>> [ 4593.956206] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
> >>> [ 4593.956219] IP: [<ffffffffa03357a4>] br_nf_forward_finish+0x154/0x170 [bridge]
> >> Not sure, but br_nf_forward_ip() has following check :
> >>
> >> if (!skb->nf_bridge)
> >> 	return NF_ACCEPT;
> >>
> >> while br_nf_forward_arp() missed this check ...
> >>
> >> So we can dereference null pointer later
> > 
> > That looks correct to me, offset 0x18 would be nf_bridge_info->mask.
> > Bart, please review, thanks.
> > 
> >> diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
> >> index 93f80fe..cd2e5f5 100644
> >> --- a/net/bridge/br_netfilter.c
> >> +++ b/net/bridge/br_netfilter.c
> >> @@ -723,6 +723,9 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
> >>  		return NF_ACCEPT;
> >>  #endif
> >>  
> >> +	if (!skb->nf_bridge)
> >> +		return NF_ACCEPT;
> >> +
> >>  	if (skb->protocol != htons(ETH_P_ARP)) {
> >>  		if (!IS_VLAN_ARP(skb))
> >>  			return NF_ACCEPT;
> 
> That won't fix it since nf_bridge isn't used in the ARP case. The
> correct fix is below. Does anyone know why the null pointer
> dereference (skb->nf_bridge->mask & BRNF_8021Q) in
> nf_bridge_update_protocol() didn't cause my uml kernel to crash??
> 
> cheers,
> Bart
> 
> 
> Don't call nf_bridge_update_protocol() for ARP traffic as
> skb->nf_bridge isn't used in the ARP case.
> 
> 
> Signed-off-by: Bart De Schuymer <bdschuym@pandora.be>
> Reported-by: Stephen Hemminger <shemminger@vyatta.com>
> 
> diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
> index 93f80fe..4442099 100644
> --- a/net/bridge/br_netfilter.c
> +++ b/net/bridge/br_netfilter.c
> @@ -643,10 +643,10 @@ static int br_nf_forward_finish(struct sk_buff *skb)
>  			skb->pkt_type = PACKET_OTHERHOST;
>  			nf_bridge->mask ^= BRNF_PKT_TYPE;
>  		}
> +		nf_bridge_update_protocol(skb);
>  	} else {
>  		in = *((struct net_device **)(skb->cb));
>  	}
> -	nf_bridge_update_protocol(skb);
>  	nf_bridge_push_encap_header(skb);
>  
>  	NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, in,
> 

This has worked all day for me without problem.
Patrick McHardy - May 13, 2010, 12:58 p.m.
Stephen Hemminger wrote:
> On Wed, 12 May 2010 16:03:54 +0200
>> Don't call nf_bridge_update_protocol() for ARP traffic as
>> skb->nf_bridge isn't used in the ARP case.
>>
>>
>> Signed-off-by: Bart De Schuymer <bdschuym@pandora.be>
>> Reported-by: Stephen Hemminger <shemminger@vyatta.com>
>>
>> diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
>> index 93f80fe..4442099 100644
>> --- a/net/bridge/br_netfilter.c
>> +++ b/net/bridge/br_netfilter.c
>> @@ -643,10 +643,10 @@ static int br_nf_forward_finish(struct sk_buff *skb)
>>  			skb->pkt_type = PACKET_OTHERHOST;
>>  			nf_bridge->mask ^= BRNF_PKT_TYPE;
>>  		}
>> +		nf_bridge_update_protocol(skb);
>>  	} else {
>>  		in = *((struct net_device **)(skb->cb));
>>  	}
>> -	nf_bridge_update_protocol(skb);
>>  	nf_bridge_push_encap_header(skb);
>>  
>>  	NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, in,
>>
> 
> This has worked all day for me without problem.

Applied, thanks everyone.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 93f80fe..4442099 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -643,10 +643,10 @@  static int br_nf_forward_finish(struct sk_buff *skb)
 			skb->pkt_type = PACKET_OTHERHOST;
 			nf_bridge->mask ^= BRNF_PKT_TYPE;
 		}
+		nf_bridge_update_protocol(skb);
 	} else {
 		in = *((struct net_device **)(skb->cb));
 	}
-	nf_bridge_update_protocol(skb);
 	nf_bridge_push_encap_header(skb);
 
 	NF_HOOK_THRESH(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, in,